[morethanwords/tweb/master](https://github.com/morethanwords/tweb/tree/master) • [96fb8c0](https://github.com/morethanwords/tweb/commit/96fb8c0cba80068e329ef3b0f2144106fd2a15e8) • _4 files, +227/-194_
Fix intermittent SRP 2FA password rejection (unpadded A)

The client public value A = g^a mod p was serialized with its minimal
big-endian length instead of being zero-padded to 256 bytes. The server
normalizes A to 256 bytes before hashing u and M1, so whenever g^a mod p
had a leading zero byte (~1/256 of attempts) our M1 mismatched the
server's and a correct password was rejected at random; a retry (fresh
account.getPassword -> new a) usually succeeded. Pad A to 256 bytes
everywhere, exactly like tdlib's A_bn.to_binary(256).

While matching tdlib's PasswordManager::get_input_check_password:
- generate the ephemeral secret a from a fresh local CSPRNG instead of
  the server-provided state.secure_random (which leaked the secret
  exponent and was constant across the now-removed retry loop);
- add the validations that were commented-out stubs: verifyDhPrimeAndGenerator
  (= check_config) for both the check and new-password paths, and the
  srp_B range/length check (0 < B < p, 248 <= len <= 256).

Rewrite src/tests/srp.test.ts into a real suite: KDF vs an independent
Node-crypto reference, a client/server SRP round-trip x25, a forced
leading-zero-A regression (mutation-confirmed it fails on the unpadded
code), the isNew verifier path, and validation throws. Drop the stale
A/M1/srp_B fixtures and the dead src/mock/srp_original.ts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

[morethanwords/tweb/master](https://github.com/morethanwords/tweb/tree/master) • [c6fb69c](https://github.com/morethanwords/tweb/commit/c6fb69c05c2e9f6a1c061052495c2a5845ac18b6) • _2 files, +1/-8_
Align reply-quote poll icon inline instead of flexing the subtitle

The poll-option checkmark in the reply/pinned container now carries the
standard inline-icon classes (inline-icon inline-icon-left) so it aligns
with the quote text through the normal inline flow, dropping the bespoke
.with-icon flex wrapper on the subtitle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

[#webk](?q=%23webk)