feat: DSC enrollment + MFA controls, user CRUD UX, auth error hardening

- DSC module: list/enroll/revoke dialogs and dsc.service (m_bank_user_dsc API)
- Access control: DSC + MFA toggles via disable-confirm-dialog
- Two-factor auth: expanded UX (DSC + OTP flows)
- Users: create/edit form polish, success snackbar on edit, DSC widget
  retained only inside dsc/ (removed from view-user)
- Auth: X-Requested-With added globally; error handler null-safe on
  empty 500 bodies

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/login/two-factor-authentication/two-factor-authentication.component.html

@@ -13,16 +13,22 @@
 
   <h2 class="tfa-title">{{ 'labels.text.Two Factor Authentication' | translate }}</h2>
   <p class="tfa-sub">
-    @if (!otpRequested) {
-      Choose how you want to receive your one-time passcode.
+    @if (dscChallengeActive) {
+      Plug in your DSC token and follow the prompts in the helper.
+    } @else if (!otpRequested) {
+      Choose how you want to verify your identity.
     } @else {
       Enter the 6-digit code we sent you to continue.
     }
   </p>
 
   <!-- Step 1 — Pick a delivery method -->
-  @if (!otpRequested) {
-    <form class="tfa-form" [formGroup]="twoFactorAuthenticationDeliveryMethodForm" (ngSubmit)="requestOTP()">
+  @if (!otpRequested && !dscChallengeActive) {
+    <form
+      class="tfa-form"
+      [formGroup]="twoFactorAuthenticationDeliveryMethodForm"
+      (ngSubmit)="continueWithSelectedFactor()"
+    >
       <div class="tfa-methods" formGroupName="">
         <mat-radio-group class="tfa-methods__group" formControlName="twoFactorAuthenticationDeliveryMethod">
           @for (method of twoFactorAuthenticationDeliveryMethods; track method.name) {
@@ -46,17 +52,17 @@
                 (click)="$event.stopPropagation()"
               ></mat-radio-button>
               <div class="tfa-method__icon">
-                <fa-icon
-                  [icon]="
-                    (method.name | lowercase) === 'sms' || (method.name | lowercase) === 'mobile'
-                      ? 'mobile-alt'
-                      : 'envelope'
-                  "
-                ></fa-icon>
+                <fa-icon [icon]="iconFor(method)"></fa-icon>
               </div>
               <div class="tfa-method__body">
                 <span class="tfa-method__name">{{ method.name | titlecase }}</span>
-                <span class="tfa-method__target">{{ maskTarget(method) }}</span>
+                <span class="tfa-method__target">
+                  @if (method.kind === 'DSC') {
+                    {{ method.target }}
+                  } @else {
+                    {{ maskTarget(method) }}
+                  }
+                </span>
               </div>
             </div>
           }
@@ -73,23 +79,66 @@
           <span>Sending…</span>
         } @else {
           <fa-icon icon="paper-plane"></fa-icon>
-          <span>{{ 'labels.buttons.Request OTP' | translate }}</span>
+          <span>Continue</span>
         }
       </button>
     </form>
   }
 
+  <!-- DSC challenge sub-screen — replaces the OTP input when DSC was picked. -->
+  @if (dscChallengeActive) {
+    <div class="tfa-context tfa-context--dsc">
+      <fa-icon icon="file-signature"></fa-icon>
+      <div>
+        <span class="tfa-context__label">Signing as</span>
+        <strong class="tfa-context__target">{{ selectedTwoFactorAuthenticationDeliveryMethod?.target }}</strong>
+      </div>
+      @if (dscCountdownLabel) {
+        <span class="tfa-context__validity">
+          <fa-icon icon="clock"></fa-icon>
+          {{ dscCountdownLabel }} remaining
+        </span>
+      }
+    </div>
+
+    <div class="tfa-dsc-hint">
+      <fa-icon icon="info-circle"></fa-icon>
+      <span>
+        A verification helper has been downloaded. If your browser didn't open it, click
+        <strong>Re-download helper</strong>. Need OpenWebStart?
+        <a href="https://openwebstart.com/" target="_blank" rel="noopener">Install it</a>.
+      </span>
+    </div>
+
+    @if (dscDetecting) {
+      <div class="tfa-dsc-spinner">
+        <mat-spinner diameter="36"></mat-spinner>
+        <span>Waiting for DSC verification…</span>
+      </div>
+    }
+
+    @if (dscFailed) {
+      <div class="tfa-error">
+        <fa-icon icon="exclamation-circle"></fa-icon>
+        {{ dscErrorMessage }}
+      </div>
+    }
+
+    <button type="button" class="tfa-btn tfa-btn--ghost" (click)="reDownloadDscHelper()" [disabled]="loading">
+      <fa-icon icon="sync-alt"></fa-icon>
+      <span>Re-download helper</span>
+    </button>
+
+    <button type="button" class="tfa-btn tfa-btn--ghost" (click)="useAnotherMethod()" [disabled]="loading">
+      <fa-icon icon="arrow-left"></fa-icon>
+      <span>Use another method</span>
+    </button>
+  }
+
   <!-- Step 2 — Enter the code -->
-  @if (otpRequested) {
+  @if (otpRequested && !dscChallengeActive) {
     <div class="tfa-context">
-      <fa-icon
-        [icon]="
-          (selectedTwoFactorAuthenticationDeliveryMethod.name | lowercase) === 'sms' ||
-          (selectedTwoFactorAuthenticationDeliveryMethod.name | lowercase) === 'mobile'
-            ? 'mobile-alt'
-            : 'envelope'
-        "
-      ></fa-icon>
+      <fa-icon [icon]="iconFor(selectedTwoFactorAuthenticationDeliveryMethod)"></fa-icon>
       <div>
         <span class="tfa-context__label">Code sent to</span>
         <strong class="tfa-context__target">{{ maskTarget(selectedTwoFactorAuthenticationDeliveryMethod) }}</strong>