v2.0.1

Fixed

• must_change_password bypass after OTP validation: users with an
  administratively-forced password change were reaching the dashboard
  without seeing the password-change screen enforced by the core. The
  plugin now emulates the core behaviour and redirects to
  login/changePassword after successful OTP, ensuring the mandatory
  change is not skipped.