Verify a TOTP code to complete MFA enrollment and enable two-factor authentication.

A wrong code is not an error. This endpoint answers the question "is this code

correct?", and false is a legitimate answer to it: the request was
well-formed, the caller is authenticated, and the check ran to completion. The outcome
is carried in the body's verified field with a 200, never as a
failure status.

This matches how the industry treats enrollment verification on an

already-authenticated session. Twilio Verify migrated this exact case from
403 to 200, reasoning that an incorrect code is normal

behaviour from a user mistyping rather than a bad request or a system issue that
warrants an error. Okta and Auth0 do answer with an error status, but for factor
verification performed during authentication, where the authentication itself
is what failed. This endpoint is guarded by isAuthenticated() and takes its user and
tenant from the JWT, so nothing about the caller is in question.

Retry limits and lockout are enforced by the enrollment service, not by this status.