Signing in to the mobile app with two-factor authentication turned on failed every time, reporting that the challenge had expired even when the code was entered immediately. The five-minute window was written in the site timezone but checked against UTC, so it was already in the past the moment it was created and no code could be accepted. Both ends now use the same clock.
Two-factor sign-in works in the mobile app again
The mobile app rejected every two-factor code as an expired challenge. The challenge was being timed against the wrong clock.