r-zakarya
e7dca84f40
The redeem client already reads `state.argon2Params = r.argon2 || null`, but the server never sent `argon2`, so it always fell back to null → the default params. Correct today (every account uses ARGON2_DEFAULT_PARAMS), but a latent wrong-key derivation the day per-account params diverge: same class as the setup verifier bug — an Argon2 account derived under the wrong params. Echo m/t/p from the users row like /login/challenge does; omitted for non-Argon2 accounts (m=0). No client change — it already consumes the field. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
