fix: surface cancelLogin failures instead of swallowing them in console

Both cancel paths (resetToPasswordFlow and handleDelete) reset the UI
optimistically and fired cancelLogin() without handling failure beyond a
console.error - on a network failure the server-side pending challenge
silently survived until its 300s TTL while the UI told the user it was
cancelled.

Extract the duplicated call into a single cancelPendingLogin() helper
that warns the user via the existing snackbar when the server-side
invalidation fails, so they know the pending verification will only die
by its own TTL. The optimistic reset is kept - the user asked to cancel,
so returning control immediately stays correct.

PR #142 review finding LOW #2.

Author: smarcet

resources/js/login/login.js

@@ -126,6 +126,22 @@ class LoginPage extends React.Component {
     this.onUseRecovery = this.onUseRecovery.bind(this);
     this.onBackToOtp = this.onBackToOtp.bind(this);
     this.resetToPasswordFlow = this.resetToPasswordFlow.bind(this);
+    this.cancelPendingLogin = this.cancelPendingLogin.bind(this);
+  }
+
+  /**
+   * Best-effort server-side invalidation of the pending MFA challenge.
+   * The UI resets optimistically; if the request fails the user is told the
+   * pending verification will only die by its own TTL.
+   */
+  cancelPendingLogin() {
+    cancelLogin(this.props.token).catch((error) => {
+      console.error("cancelLogin failed", error);
+      this.showAlert(
+        "We couldn't cancel the pending verification on the server. It will expire on its own in a few minutes.",
+        "warning",
+      );
+    });
   }
 
   showAlert(message, severity) {
@@ -315,9 +331,7 @@ class LoginPage extends React.Component {
         password: "",
       },
     });
-    cancelLogin(this.props.token).catch((error) => {
-      console.error("cancelLogin failed", error);
-    });
+    this.cancelPendingLogin();
   }
 
   /**
@@ -643,9 +657,7 @@ class LoginPage extends React.Component {
       // A pending 2FA/recovery challenge was issued server-side (session
       // 2fa_pending_user_id + an unredeemed OTP); invalidate it the same
       // way "Cancel" does instead of leaving it live until its TTL.
-      cancelLogin(this.props.token).catch((error) => {
-        console.error("cancelLogin failed", error);
-      });
+      this.cancelPendingLogin();
     }
     this.setState({
       ...this.state,