fix: password sign-in for 2FA accounts could silently bounce to /login (v0.50.1)

signIn.email() resolves with error: null and data.twoFactorRedirect: true
for 2FA-enabled accounts — no full session exists yet. The login page's
handleSubmit treated any non-error response as fully signed in and called
router.push("/recipes"), racing better-auth's own window.location.href
redirect to /verify-2fa (twoFactorClient's onSuccess hook). When the app's
push won that race, middleware bounced the unauthenticated /recipes
request straight back to /login with no error surfaced — looked like the
page just reloaded.

Now explicitly skips the /recipes push when twoFactorRedirect is set,
leaving the SDK's own redirect to run uncontested.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(auth)/login/page.tsx

@@ -25,7 +25,7 @@ export default function LoginPage() {
     e.preventDefault();
     setUnverified(false);
     setLoading(true);
-    const { error } = await authClient.signIn.email({ email, password, callbackURL: "/recipes" });
+    const { data, error } = await authClient.signIn.email({ email, password, callbackURL: "/recipes" });
     setLoading(false);
     if (error) {
       if (error.code === "EMAIL_NOT_VERIFIED") {
@@ -33,7 +33,11 @@ export default function LoginPage() {
       } else {
         toast.error(error.message ?? "Sign in failed");
       }
-    } else {
+    } else if (!(data as { twoFactorRedirect?: boolean } | null)?.twoFactorRedirect) {
+      // 2FA-enabled accounts resolve with no `error` but `twoFactorRedirect: true` —
+      // no full session exists yet, so pushing to /recipes here races the SDK's own
+      // window.location.href to /verify-2fa (see twoFactorClient's onSuccess hook)
+      // and can lose, bouncing off middleware back to /login with no visible error.
       router.push("/recipes");
     }
   }