TOTP codes from Apple Passwords are wiped on the login screen

Describe the bug

Support Thread move to github from https://wordpress.org/support/topic/totp-codes-from-apple-passwords-are-wiped-on-the-login-screen/

Apple Passwords (iOS 18 / macOS Sequoia) autofills TOTP codes correctly into the verification field, but the code disappears immediately, and the form submits empty.
Three things cause this:

The login form tag sets autocomplete=”off”, which tells Apple Passwords not to autofill — conflicting with the autocomplete=”one-time-code” on the input itself.
two-factor-login.js runs d.value = ” after 200 ms, blanking any code that was already autofilled.
The space-insertion logic in two-factor-login-authcode.js uses a spaceInserted flag that doesn’t reset properly when a full code arrives at once via autofill rather than character-by-character typing.

Affects Google Password Manager and other platform autofill providers too, not just Apple.
Environment: WordPress 6.7, Two Factor 0.16.0, Safari 18 / iOS 18.

Steps to Reproduce

Screenshots, screen recording, code snippet

No response

Environment information

No response

Please confirm that you have searched existing issues in this repository.

Yes

Please confirm that you have tested with all plugins deactivated except Two-Factor.

Yes

Start by reading two-factor-login.js and two-factor-login-authcode.js, then locate the login form markup that sets autocomplete="off". Reproduce the Apple Passwords or other autofill flow described in the issue and verify that a complete autofilled code remains in the verification field, is formatted correctly, and submits successfully.