Check how the Telegram sign-in is going

Poll this while the person has the QR in front of them. Reading it has no side effect other than marking the credentials verified once the sign-in completes.

FOUR states, and the difference between them is the whole point of this endpoint — collapsing them into "done / not done" loses exactly the information you are polling for:

waiting — nobody has approved the sign-in yet. Keep polling; do not touch the POST endpoint. authorized — done. The account is signed in and its credentials are now verified. Stop polling. 2fa_required — THE SCAN SUCCEEDED. The account has two-step verification on, so one more thing is needed: the password. Do NOT issue a new QR here — re-issuing throws away the successful scan and sends the person back to scanning in a loop, which is the single most likely way to misuse this API. Ask for a link instead: POST /api/v1/credentials/telegram_2fa/request, show it, and poll that request. The password never travels through you. When it reads verified, this endpoint will read authorized. expired — the token you issued died before anyone approved it. This is the ONLY state that means "issue a new QR". Poll for this state rather than timing it yourself: the server knows when the token it handed out dies and you do not, and a hardcoded countdown has already shipped a QR that stayed on screen forever after expiry.