[jay23606]

TOTPService.Verify now returns a distinct persistence error when storing a failed-attempt count or lockout state fails. Identity and HTTP callers preserve that error so a storage failure is reported as a server error, while successfully persisted invalid codes continue to return the normal invalid-credentials response.

Fixes #10

Validation:

• Regression test on clean base: failed for both ordinary failed-count and lockout-threshold cases, returning invalid TOTP code after the injected write failure.
• Regression test on this branch: passed for both cases.
• Relevant Go tests and go vet ./internal/auth ./internal/identity ./internal/web/handler: passed.
• Frontend typecheck, SEO, toolchain, and playground tests: passed.
• Existing project-wide failures reproduced on clean base: Go documentation tests, frontend documentation tests, and server-transfer tests.