various improvements (#2671)

* improve oauth config logic

* expire pending login

* move sort to backend

src/server/api/auth/password.post.ts

@@ -32,6 +32,8 @@ export default defineEventHandler(async (event) => {
             type: 'password',
             userId: result.userId,
             remember,
+            // 5min
+            expires_at: Date.now() + 5 * 60 * 1000,
           },
         });
         return { status: 'TOTP_REQUIRED' as const };