Show a separate MM:SS code-validity countdown using expiresInSeconds from the existing email API. The inspected backend uses CODE_TTL_MS = 10 * 60_000 and returns 600 seconds, consistent with its one-use email wording.

Anchor validity to the local request start, conservatively deducting delivery and network latency. This is duration-based synchronization, not exact server clock alignment: the API does not return an expiry timestamp. Recompute absolute deadlines on foreground and use deadlines for resending too. Throttling or reopening does not extend an existing expiry. A successful resend clears the old code and starts a new lifetime. Unknown earlier codes remain server-checked; after a full restart, do not fabricate a fresh ten-minute validity.

Known-expired codes cannot submit, even through an old click handler. Expiration never deletes an account or sends an email: only an explicit final click can request erasure, and the backend remains authoritative.

Six new screen regressions cover TTL, expiry, delivery delay, background time, reopening/throttling/unknown expiry and renewal with explicit-click submission. Observed Red evidence exists for the countdown and expiry guard. Lint, TypeScript, Android build and 2,826 tests pass (11 skipped). Installed in the emulator without clearing data; no real email was requested and no real account was deleted. Maestro is unavailable: the included QA-mailbox-only flow was not executed. Live email-countdown acceptance remains for the user. No backend deployment, migration, dependencies or persistent OTP storage were added. iOS was not built.

Mobile PR: https://github.com/snag-tcg/poc-tcg-collector/pull/790