Support provider credential renewal and reject unsuccessful OTP validation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

.forgejo/workflows/acceptance.yaml

@@ -0,0 +1,20 @@
+name: Authentication acceptance
+on:
+  push:
+    branches: [main]
+    paths: ["src/**", ".forgejo/workflows/acceptance.yaml"]
+  workflow_dispatch:
+jobs:
+  acceptance:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.23-alpine
+    steps:
+      - name: Test exact source revision
+        run: |
+          set -eu
+          wget -qO /tmp/keycape-source.tar.gz "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
+          mkdir -p /tmp/keycape-acceptance
+          tar xzf /tmp/keycape-source.tar.gz -C /tmp/keycape-acceptance --strip-components=1
+          cd /tmp/keycape-acceptance/src
+          /usr/local/go/bin/go test ./...