TOTP deeplink codes aren't one-use

**Describe the bug**

Timed one-time-passcode is what TOTP stands for, and whilst the passcode is timed, it isn't one-use, you can reuse it until the timer expires.

**To Reproduce**

Use TOTP, use the code twice in a row to launch a prompt.

**Expected behavior**

A one time passcode can be used once.

**Additional context**

Once per prompt window, or once per approved prompt?

Start by reproducing the TOTP deeplink flow described in the issue, launching a prompt and submitting the same code twice. Trace the deeplink and prompt entry points, then check existing tests around TOTP use. Done means a code cannot be reused, with the intended once-per-prompt or once-per-approved-prompt behavior clarified and covered by tests.

Written by the indexing model from the issue text.