fix: expire abandoned auth attempts

server/domain/auth.go

@@ -130,6 +130,26 @@ func (c *AuthCoordinator) Get(attemptID string) (AuthAttempt, error) {
 	return attempt, nil
 }
 
+// Expire closes abandoned pending attempts. The caller should run this from
+// the auth maintenance loop; accepted and already terminal attempts are left
+// unchanged so audit/reconciliation can still inspect their outcome.
+func (c *AuthCoordinator) Expire(now time.Time) []AuthAttempt {
+	if c == nil || now.IsZero() {
+		return nil
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	var expired []AuthAttempt
+	for id, attempt := range c.attempts {
+		if attempt.State == AuthPending && !now.Before(attempt.ExpiresAt) {
+			attempt.State = AuthRejected
+			c.attempts[id] = attempt
+			expired = append(expired, attempt)
+		}
+	}
+	return expired
+}
+
 var (
 	ErrTicketRejected  = fmt.Errorf("steam ticket rejected")
 	ErrSessionRejected = fmt.Errorf("session rejected")