POST `/mfa/push/deny`

User denies a Push MFA challenge via device. Reference: NIST SP 800-63B §5.1.7 (Verifier Impersonation Resistance), OWASP ASVS V2.8.

Multi-Factor Authentication `bearerAuth` application/json

Request Body

Schema: dto.PushDenyRequest

Field	Type	Required	Example
`challenge_id`	`string`	Yes	`chal-abc123`
`number_matching`	`string`	Yes	`42`
`device_key`	`string`	No	`hmac-sig`

Status	Description	Schema
200	Denied successfully	`dto.ValidDetailResponse`
400	Invalid parameter or challenge expired	`gitee_com_linmes_authms_base_dto.SimpleResponse`
401	Unauthenticated	`gitee_com_linmes_authms_base_dto.SimpleResponse`
404	Challenge not found	`gitee_com_linmes_authms_base_dto.SimpleResponse`
500	Internal server error	`gitee_com_linmes_authms_base_dto.SimpleResponse`

Field	Type	Required
`code`	`integer`	No
`data`	`dto.ValidResponse`	No
`message`	`string`	No
`timestamp`	`string`	No

Field	Type	Required	Example	Constraints	Description
`valid`	`boolean`	No	`True`

Field	Type	Required
`code`	`integer`	No
`message`	`string`	No
`timestamp`	`string`	No