[Enhancement] Support rendering registered tokens and "last used" timestamp on login page

[katgirl]

Type

Feature Request / Enhancement

Description

To improve user experience and security awareness, it would be highly beneficial if the plugin could expose a list of the authenticating user's currently registered tokens (including their types and last activation timestamps) to the Velocity context.

Currently, users face a generic prompt during the MFA step. Allowing the login UI (privacyidea-login.vm) to dynamically list available factors (e.g., TOTP, WebAuthn/Passkey, Push) and when they were last successfully used (last_match) helps users choose the correct token type and spot potential fraudulent activity early on.

Suggested Requirements / Acceptance Criteria

• The plugin fetches the user's active token metadata from the privacyIDEA backend during the authentication flow.
• Token details (Type, Description, and last_match timestamp) are pushed into the Velocity context (privacyidea-login.vm).
• Safe fallback/default behavior is provided if a user has no tokens or if the backend response is delayed.

Technical Context / Considerations

• This should be fully compatible with the standard Shibboleth IdP v5 authentication flow.
• Ideally, the attribute mapping from the privacyIDEA JSON response to the Velocity context variables should be configurable via privacyidea.properties.