Aug 27 - Update free-plan gate, MFA is no longer bypassable via the app

app/api/errors.py

@@ -31,13 +31,24 @@ def api_ok(data=None, status=200):
     }), status
 
 
-def api_error(message: str, status: int = 400):
-    """Return an error JSON response."""
-    return jsonify({
+def api_error(message: str, status: int = 400, extra: dict | None = None):
+    """Return an error JSON response.
+
+    `extra` merges additional top-level keys into the envelope — for flags a
+    client must branch on rather than parse out of the message, e.g.
+    `mfa_required` on a login that needs a second factor. Reserved keys
+    (ok/data/error) always win, so a caller cannot accidentally rewrite the
+    envelope's shape.
+    """
+    payload = {
         'ok':    False,
         'data':  None,
         'error': message,
-    }), status
+    }
+    if extra:
+        for k, v in extra.items():
+            payload.setdefault(k, v)
+    return jsonify(payload), status
 
 
 # ── Registered error handlers (attached to the api blueprint) ─────────────────