When reauthenticating, the login form should use a simplified user experience, not the full login experience.
- Display a banner explaining that the user is reauthenticating, and which action they're about to take
- Add a link that allows the user to cancel the action
- The user name should be displayed, but should not be editable
- If the user has 2FA
- Don't ask for the password
- Display a "Continue with passkey" button that does the same thing as the current "Log in with passkey" button
- Display the "Use X" buttons for the other 2FA mechanisms the user has enrolled (security key, authenticator app, recovery codes)
- If the user doesn't have 2FA, ask for their password
Figma: https://www.figma.com/design/u2ilwdqUunQgQpPhLM3FxS/T197160?node-id=247-1422&p=f&m=dev
MW core doesn't know about 2FA and can't check for it directly, but we could implement this by leaving the login form in core mostly unmodified (except for not making the user name not editable), and making all the other changes in the OATHAuth extension.