fix(auth): fall back for Turtle security extensions

[paleophyte]

Summary

• My Turtle WoW server really doesn't want to accept auth protocol-3.
• prefer the profile auth protocol first, then retry the alternate vanilla auth protocol only for protocol-shaped failures
• handle Turtle/vmangos security-extension challenges and short BUSY responses without retrying bad credentials
• improve 2FA/PIN entry UX and clarify Turtle proof rejection messages
• add focused auth packet regression coverage for legacy/v8 PIN proof sizing

Validation

• CI passed on fix(auth): fall back for Turtle security extensions paleophyte/WoWee#16
• cmake --build build --target test_realm_list --config Debug
• ./build/bin/test_realm_list.exe

WOWEE_LOG_LEVEL=debug ./build/bin/wowee
...
[2026-07-15 17:23:17.036] [DEBUG] Handling LOGON_CHALLENGE response
[2026-07-15 17:23:17.036] [INFO ] LOGON_CHALLENGE response: Success
[2026-07-15 17:23:17.036] [DEBUG] Parsed LOGON_CHALLENGE response:
[2026-07-15 17:23:17.036] [DEBUG]   B size: 32 bytes
[2026-07-15 17:23:17.036] [DEBUG]   g size: 1 bytes
[2026-07-15 17:23:17.036] [DEBUG]   N size: 32 bytes
[2026-07-15 17:23:17.036] [DEBUG]   salt size: 32 bytes
[2026-07-15 17:23:17.036] [DEBUG]   Security flags: 1
[2026-07-15 17:23:17.036] [DEBUG]   PIN grid seed: 2613764122
[2026-07-15 17:23:17.036] [WARN ] Server sent security flags: 0x1
[2026-07-15 17:23:17.036] [WARN ]   PIN required
[2026-07-15 17:23:17.036] [INFO ] Challenge: N=32B g=1B salt=32B secFlags=0x1
[2026-07-15 17:23:17.036] [ERROR] Authentication failed: Server requires auth protocol 8 security extensions
[2026-07-15 17:23:17.036] [DEBUG] Auth state: 2 -> 10
[2026-07-15 17:23:17.037] [INFO ] Auth failed on protocol 3 (Server requires auth protocol 8 security extensions) - retrying with protocol 8
...
[2026-07-15 17:23:19.315] [INFO ] Server proof verified successfully!
[2026-07-15 17:23:19.315] [DEBUG] Auth state: 6 -> 7
[2026-07-15 17:23:19.315] [INFO ] ========================================
[2026-07-15 17:23:19.315] [INFO ]    AUTHENTICATION SUCCESSFUL!
[2026-07-15 17:23:19.315] [INFO ] ========================================

[Kelsidavis]

Thanks for the fix — merged! The protocol-related retry for security-extension challenges and the 2FA UX improvements are all in.

One follow-up in aaebd4f, so you know why part of this changed after merge:

• Restored the trailing security-flags byte in buildLegacy. The 1.11+ vanilla LOGON_PROOF is read by mangos-family realmd as a fixed-size struct that ends with number_of_keys + securityFlags, so the legacy proof needs the byte even though it carries no PIN/token payload — omitting it stalls the server's read against stock protocol-3 realms (old mangos/cmangos), which are the only servers that path exists for. Your Turtle server never sees the legacy proof anymore (the challenge now fails early and retries as v8), which is why this didn't show up in your testing. The size-assertion test was updated to match (73 → 74 bytes).
• Turtle profile now defaults to protocolVersion: 8 with 3 as the fallback, so Turtle logins skip the doomed protocol-3 first attempt (and its failed connection) entirely. The fallback chain you kept in place still covers vanilla servers that want 3.