backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

product/business/01-actors-and-onboarding.html

@@ -29,6 +29,7 @@
 </ul>
 </li>
 <li>Each successful login creates a refresh-token session that can be revoked (logout, stolen-token detection).</li>
+<li><strong>As-built decisions (backend-phase-2):</strong> each refresh <strong>rotates</strong> the session (old revoked, new pair issued); a refresh token presented against an already-revoked session is treated as <strong>stolen-token reuse → all of the user's sessions are revoked and the call returns 401</strong>. Logout rotates the security stamp, so every outstanding access token dies (other devices recover by refreshing). OTP request/verify never reveal whether a phone already has an account; one OTP per phone per resend window (<code>auth_otp_resend_seconds</code>), and after <code>auth_otp_max_attempts</code> wrong codes verification refuses until a fresh OTP. <code>customer</code>/<code>nurse</code> are the only self-selectable roles (a user may hold both; grants audited via <code>granted_by</code>/<code>granted_at</code>); any admin sub-role self-assign attempt returns <strong>403</strong> — admin provisioning is internal-only.</li>
 </ul>
 <h2 id="b-iran-specific-considerations">(b) Iran-specific considerations <a class="anchor" href="#b-iran-specific-considerations" aria-hidden="true">#</a></h2>
 <ul>