fix(auth): the rotating 2FA verify routes echo the live user row, not the pre-rotation snapshot

fix(auth): the rotating 2FA verify routes echo the live user row, not the pre-rotation snapshot #11079