Changes
- harden login/session state handling across relogin, logout, settings init, and session bootstrap paths
- clear stale cookies and headers more consistently to reduce drift between private/public session state
- improve challenge flow handling for SMS/email choice preservation and correct numeric payloads in both private and contact-form challenge paths
- replace several raw challenge assertions with clearer
ChallengeError/ChallengeRequiredflows - expand regression coverage for login, session, and challenge edge cases