backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Logging/LoggingConfiguration.cs

@@ -36,7 +36,8 @@ public static class LoggingConfiguration
         columnOpts.PrimaryKey = columnOpts.Id;
         columnOpts.Id.DataType = SqlDbType.Int;
 
-        if (!context.HostingEnvironment.IsDevelopment())
+        // Development and Testing (WebApplicationFactory) log locally; the SQL sink is for deployed envs.
+        if (!context.HostingEnvironment.IsDevelopment() && !context.HostingEnvironment.IsEnvironment("Testing"))
         {
             configuration.WriteTo
                 .MSSqlServer(

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/LoggingSmsSender.cs

@@ -0,0 +1,28 @@
+using Baya.Application.Contracts.Common;
+using Microsoft.Extensions.Logging;
+
+namespace Baya.Infrastructure.CrossCutting.Seams;
+
+/// <summary>
+/// Mock <see cref="ISmsSender"/>: "delivers" by logging. The OTP code is written to the log so a
+/// developer can complete the login flow; the phone number is never logged in full (PII policy) —
+/// only its last four digits. The real implementation swaps to an Iranian SMS gateway
+/// (Kavenegar/Ghasedak/SMS.ir) behind the same interface via a registration change.
+/// </summary>
+public sealed class LoggingSmsSender(ILogger<LoggingSmsSender> logger) : ISmsSender
+{
+    public Task SendOtpAsync(string phone, string code, CancellationToken cancellationToken = default)
+    {
+        logger.LogWarning("MOCK SMS — OTP code {OtpCode} for phone ending in {PhoneTail}", code, Tail(phone));
+        return Task.CompletedTask;
+    }
+
+    public Task SendAsync(string phone, string message, CancellationToken cancellationToken = default)
+    {
+        logger.LogWarning("MOCK SMS — message to phone ending in {PhoneTail}: {Message}", Tail(phone), message);
+        return Task.CompletedTask;
+    }
+
+    private static string Tail(string phone) =>
+        string.IsNullOrEmpty(phone) ? "????" : phone[^Math.Min(4, phone.Length)..];
+}

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/ServiceConfiguration/ServiceCollectionExtension.cs

@@ -8,7 +8,7 @@ namespace Baya.Infrastructure.CrossCutting.ServiceConfiguration;
 public static class ServiceCollectionExtension
 {
     /// <summary>
-    /// Registers the cross-cutting seams (time, PII encryption, cache, object storage) with their
+    /// Registers the cross-cutting seams (time, PII encryption, cache, object storage, SMS) with their
     /// in-memory/local mock implementations. Swapping in a real provider later is a registration change
     /// here — callers depend only on the Application contracts. (The real in-app
     /// <c>INotificationDispatcher</c> needs the database, so it is registered in the Persistence layer.)
@@ -24,6 +24,10 @@ public static class ServiceCollectionExtension
         services.AddSingleton<ICacheService, MemoryCacheService>();
         services.AddSingleton<IObjectStorage, LocalDiskObjectStorage>();
 
+        // OTP/SMS delivery rail (backend-phase-2). The mock logs the code; a real gateway client
+        // (Kavenegar/Ghasedak/SMS.ir) replaces this registration only.
+        services.AddSingleton<ISmsSender, LoggingSmsSender>();
+
         return services;
     }
 }