feat: trusted devices and 'remember me'

[bjoern-m]

Description

This PR implements functionality for prompting users to trust their device during login, as well as handling persistent and temporary session management based on the user's preference.

1. Prompt for Device Trust

• Users are prompted to trust their device before completing the login flow with MFA.

2. Trusting the Device

• Skip MFA for Trusted Devices: Trusted devices bypass Multi-Factor Authentication (MFA) on subsequent logins.

3. Device Trust:

• A unique, randomized device_token is generated and stored in the database upon trust confirmation.
• The device_token is shared with the client via a cookie.
• On subsequent logins, the backend validates the device_token by matching it in the database.
• Trust persists until it explicitly expires.
• The expiration period is not extended by subsequent logins.

4. "Remember Me" Functionality

• Users can opt to "Remember me" / "Stay signed in" during the registration or login process.

Implementation

1. Backend Changes:

• Added API support for prompting and processing the device trust option.
• Implemented trust_device cookie generation and validation.
• Database schema extended to store device_token with expiration timestamps.

2. Frontend Changes:

• Updated UI to prompt for device trust.
• Added a "Remember me" checkbox and corresponding logic for session persistence.

Future Enhancements

• Enable trust revocation from the user’s account settings.
• Retain the checked state of the "Remember Me" or "Stay Signed In" checkbox and store the previously used login identifier.