test(phase-07.1): add Nyquist validation tests for sessions_revoked frontend behavior

3 positive + 2 negative Vitest tests covering CR-01/02/03 toast UX:
- SettingsAccountTab: toast appears/hidden after changePassword (CR-01)
- SettingsAccountTab: toast appears after disableTotp (CR-03)
- TotpEnrollment: inline alert appears/hidden after enable_totp (CR-02)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/auth/__tests__/TotpEnrollment.test.js

@@ -18,6 +18,7 @@ vi.mock('../../../api/client.js', () => ({
   totpEnable: vi.fn(),
 }))
 
+import { totpEnable as totpEnableMock } from '../../../api/client.js'
 import TotpEnrollment from '../TotpEnrollment.vue'
 
 beforeEach(() => {
@@ -80,3 +81,69 @@ describe('TotpEnrollment — QR code rendering (AUTH-03)', () => {
     expect(wrapper.text()).toContain('JBSWY3DPEHPK3PXP')
   })
 })
+
+// ─── GAP 3: Sessions revoked inline alert (CR-02) ───────────────────────────
+
+describe('TotpEnrollment — sessions revoked toast (CR-02)', () => {
+  const mountStubs = {
+    AppSpinner: { template: '<span />' },
+    BackupCodesDisplay: { template: '<div />', props: ['codes'] },
+  }
+
+  it('renders "Other sessions have been terminated." after totpEnable returns sessions_revoked > 0 (CR-02)', async () => {
+    vi.mocked(totpEnableMock).mockResolvedValueOnce({
+      backup_codes: ['CODE1', 'CODE2'],
+      sessions_revoked: 1,
+    })
+
+    const wrapper = mount(TotpEnrollment, {
+      global: {
+        plugins: [createPinia()],
+        stubs: mountStubs,
+      },
+    })
+
+    // Move component from 'setup' step → 'verify' step by clicking the setup button
+    await wrapper.find('button').trigger('click')
+    await flushPromises()
+
+    // Now in 'verify' step — find the code input and set a 6-digit value
+    const codeInput = wrapper.find('input[inputmode="numeric"]')
+    expect(codeInput.exists()).toBe(true)
+    await codeInput.setValue('123456')
+
+    // Click "Verify code" button to trigger confirmEnrollment()
+    const verifyBtn = wrapper.findAll('button').find(b => b.text().includes('Verify code'))
+    expect(verifyBtn).toBeDefined()
+    await verifyBtn.trigger('click')
+    await flushPromises()
+
+    expect(wrapper.text()).toContain('Other sessions have been terminated.')
+  })
+
+  it('does NOT render the alert when totpEnable returns sessions_revoked is 0 (CR-02 negative)', async () => {
+    vi.mocked(totpEnableMock).mockResolvedValueOnce({
+      backup_codes: [],
+      sessions_revoked: 0,
+    })
+
+    const wrapper = mount(TotpEnrollment, {
+      global: {
+        plugins: [createPinia()],
+        stubs: mountStubs,
+      },
+    })
+
+    await wrapper.find('button').trigger('click')
+    await flushPromises()
+
+    const codeInput = wrapper.find('input[inputmode="numeric"]')
+    await codeInput.setValue('123456')
+
+    const verifyBtn = wrapper.findAll('button').find(b => b.text().includes('Verify code'))
+    await verifyBtn.trigger('click')
+    await flushPromises()
+
+    expect(wrapper.text()).not.toContain('Other sessions have been terminated.')
+  })
+})