fix: update TOTP reuse test to use user10 matching rebased fixture

pkg/db/fixtures/totp.yml

@@ -1,5 +1,11 @@
 - id: 1
-  user_id: 1
+  user_id: 10
   secret: 'JBSWY3DPEHPK3PXP'
   enabled: true
-  url: 'otpauth://totp/Vikunja:user1?secret=JBSWY3DPEHPK3PXP&issuer=Vikunja'
+  url: 'otpauth://totp/Vikunja:user10?secret=JBSWY3DPEHPK3PXP&issuer=Vikunja'
+# user1 has TOTP enrolled but not yet enabled — used by existing TOTP enrollment tests
+- id: 2
+  user_id: 1
+  secret: 'HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ'
+  enabled: false
+  url: 'otpauth://totp/Vikunja:user1?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=Vikunja'

pkg/user/totp_test.go

@@ -32,12 +32,13 @@ func TestTOTPPasscodeCannotBeReused(t *testing.T) {
 	s := db.NewSession()
 	defer s.Close()
 
-	// Generate a valid TOTP passcode for user1's secret from the fixture
+	// Generate a valid TOTP passcode for user10's secret from the fixture
+	// user10 has TOTP enabled with this secret in pkg/db/fixtures/totp.yml
 	secret := "JBSWY3DPEHPK3PXP" //nolint:gosec
 	passcode, err := totp.GenerateCode(secret, time.Now())
 	require.NoError(t, err)
 
-	user := &User{ID: 1}
+	user := &User{ID: 10}
 
 	// First use should succeed
 	_, err = ValidateTOTPPasscode(s, &TOTPPasscode{