GO-2026-6057 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface in code.gitea.io/gitea...