fix: mock EmailOTPMFAChallengeStrategy's new getCreatedAt() call in unit tests

CI broke on push: issueChallenge()/resendChallenge() gained a call to
$otp->getCreatedAt() in an earlier commit this session (0330c3b, seeding
the MFA countdown with the OTP's actual issuance time), but the strict
Mockery mocks in EmailOTPMFAChallengeStrategyTest never declared that
expectation - BadMethodCallException on every call, in both
testIssueChallenge_storesPendingStateAndReturnsOtpInfo and
testResendChallenge_delegatesToIssueChallenge.

Only ran tests/TwoFactorLoginFlowTest.php locally in that earlier commit
(the file the plan named), not the full suite - this unit test file was
never exercised until CI's own full run caught it.

Mock getCreatedAt() with a fixed DateTime and extend both tests'
assertSame() to include the new otp_issued_at key in the expected
result array, matching the real return shape.

Verified in isolation: 5 tests, 8 assertions, green.

Author: smarcet

tests/Unit/MFA/EmailOTPMFAChallengeStrategyTest.php

@@ -50,9 +50,12 @@ public function testIssueChallenge_storesPendingStateAndReturnsOtpInfo(): void
     {
         $user = $this->buildUser(42, 'user@example.com');
 
+        $issuedAt = new \DateTime('2026-01-01 00:00:00', new \DateTimeZone('UTC'));
+
         $otp = \Mockery::mock(OAuth2OTP::class);
         $otp->shouldReceive('getLength')->andReturn(6);
         $otp->shouldReceive('getLifetime')->andReturn(120);
+        $otp->shouldReceive('getCreatedAt')->andReturn($issuedAt);
 
         $this->tokenService
             ->shouldReceive('createOTPFromPayload')
@@ -67,7 +70,10 @@ public function testIssueChallenge_storesPendingStateAndReturnsOtpInfo(): void
 
         $result = $this->strategy->issueChallenge($user, null, true);
 
-        $this->assertSame(['otp_length' => 6, 'otp_lifetime' => 120], $result);
+        $this->assertSame(
+            ['otp_length' => 6, 'otp_lifetime' => 120, 'otp_issued_at' => $issuedAt->getTimestamp()],
+            $result
+        );
         $this->assertSame(42, Session::get('2fa_pending_user_id'));
         $this->assertTrue(Session::get('2fa_remember'));
     }
@@ -78,9 +84,12 @@ public function testResendChallenge_delegatesToIssueChallenge(): void
     {
         $user = $this->buildUser(7, 'resend@example.com');
 
+        $issuedAt = new \DateTime('2026-01-01 00:00:00', new \DateTimeZone('UTC'));
+
         $otp = \Mockery::mock(OAuth2OTP::class);
         $otp->shouldReceive('getLength')->andReturn(6);
         $otp->shouldReceive('getLifetime')->andReturn(120);
+        $otp->shouldReceive('getCreatedAt')->andReturn($issuedAt);
 
         $this->tokenService
             ->shouldReceive('createOTPFromPayload')
@@ -89,7 +98,10 @@ public function testResendChallenge_delegatesToIssueChallenge(): void
 
         $result = $this->strategy->resendChallenge($user, null, false);
 
-        $this->assertSame(['otp_length' => 6, 'otp_lifetime' => 120], $result);
+        $this->assertSame(
+            ['otp_length' => 6, 'otp_lifetime' => 120, 'otp_issued_at' => $issuedAt->getTimestamp()],
+            $result
+        );
         $this->assertSame(7, Session::get('2fa_pending_user_id'));
     }