reject invalid TOTP codes

[xi]

1 digit codes are obviously insecure, yet mauth will happily accept them. The spec is unfortunately unclear about what to do in those cases. I propose to flag them as invalid or at least show a warning.

See also https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/