backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/settings.local.json

@@ -59,7 +59,33 @@
       "Bash(nohup dotnet run --project src/API/Baya.Web.Api/Baya.Web.Api.csproj --no-build --no-launch-profile)",
       "Bash(echo \"started pid $!\")",
       "Bash(Get-ChildItem -Path \"c:\\\\Users\\\\Lenovo\\\\Desktop\\\\balinyaar\\\\server\" -Recurse -Directory)",
-      "Bash(Select-Object FullName)"
+      "Bash(Select-Object FullName)",
+      "Bash(dotnet ef *)",
+      "Bash(dotnet test *)",
+      "Bash(ASPNETCORE_ENVIRONMENT=Development ASPNETCORE_URLS=\"http://localhost:5080\" dotnet run --project src/API/Baya.Web.Api/Baya.Web.Api.csproj --no-build)",
+      "Bash(curl -sk https://localhost:5002/swagger/v1/swagger.json -o \"c:/Users/Lenovo/Desktop/balinyaar/dev/contracts/openapi/swagger.v1.json\")",
+      "Bash(curl -sk https://localhost:5002/api/v1/ping/get_status)",
+      "Bash(taskkill //F //IM Baya.Web.Api.exe)",
+      "Bash(taskkill //F //IM dotnet.exe //FI \"MEMUSAGE gt 90000\")",
+      "Bash(tasklist)",
+      "Bash(ASPNETCORE_ENVIRONMENT=Development dotnet run --project src/API/Baya.Web.Api/Baya.Web.Api.csproj --no-build)",
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(xargs echo \"remaining unstaged/untracked entries:\")",
+      "Bash(git commit -m ' *)",
+      "Bash(dotnet sln *)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\" http://localhost:5188/swagger/v1/swagger.json)",
+      "Read(//c/Users/Lenovo/AppData/Local/Temp/claude/c--Users-Lenovo-Desktop-balinyaar/9f660ead-4935-40d5-9ba2-c846d642a0db/scratchpad/**)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\\\\n\" http://localhost:5188/api/v1/me)",
+      "Bash(curl -s http://localhost:5188/api/v1/me -H 'Authorization: Bearer __TRACKED_VAR__')",
+      "Bash(curl -s -X POST http://localhost:5188/api/v1/auth/refresh -H 'Content-Type: application/json' -d '{\"refreshToken\":\"__TRACKED_VAR__\"}')",
+      "Bash(node -e \"const d=JSON.parse\\(require\\('fs'\\).readFileSync\\('step5.json'\\)\\); console.log\\('status ok:',d.isSuccess,'| roles:',JSON.stringify\\(d.data.roles\\)\\); require\\('fs'\\).writeFileSync\\('at2.txt',d.data.accessToken\\)\")",
+      "Bash(curl -s -o /dev/null -w '%{http_code}\\\\n' -X POST http://localhost:5188/api/v1/auth/refresh -H 'Content-Type: application/json' -d '{\"refreshToken\":\"__TRACKED_VAR__\"}')",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\\\\n\" -X POST http://localhost:5188/api/v1/auth/verify_otp -H \"Content-Type: application/json\" -d '{\"phone\":\"09121112233\",\"code\":\"000000\"}')",
+      "Bash(curl -s -o /dev/null -w '%{http_code}\\\\n' -X POST http://localhost:5188/api/v1/auth/logout -H 'Authorization: Bearer __TRACKED_VAR__' -H 'Content-Type: application/json' -d '{}')",
+      "Bash(curl -s -o /dev/null -w '%{http_code}\\\\n' http://localhost:5188/api/v1/me -H 'Authorization: Bearer __TRACKED_VAR__')",
+      "Bash(curl -s -o /dev/null -w \"%{http_code} \" -X POST http://localhost:5188/api/v1/auth/request_otp -H \"Content-Type: application/json\" -d '{\"phone\":\"09121112244\"}')",
+      "Bash(curl -s http://localhost:5188/swagger/v1/swagger.json -o /c/Users/Lenovo/Desktop/balinyaar/dev/contracts/openapi/swagger.v1.json)"
     ],
     "defaultMode": "bypassPermissions",
     "additionalDirectories": [