backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/Infrastructure/Baya.Infrastructure.Identity/Identity/SeedDatabaseService/SeedDataBase.cs

@@ -1,4 +1,4 @@
-using Baya.Domain.Entities.User;
+using Baya.Domain.Entities.User;
 using Baya.Infrastructure.Identity.Identity.Manager;
 using Microsoft.EntityFrameworkCore;
 
@@ -22,13 +22,17 @@ public class SeedDataBase : ISeedDataBase
 
     public async Task Seed()
     {
-        if (!_roleManager.Roles.AsNoTracking().Any(r => r.Name.Equals("admin")))
+        // The full role vocabulary: public actor roles (customer/nurse — self-selectable) and the
+        // admin sub-roles (internally provisioned only, never self-assignable).
+        foreach (var roleName in RoleNames.All)
         {
-            var role=new Role
+            if (!_roleManager.Roles.AsNoTracking().Any(r => r.Name.Equals(roleName)))
             {
-                Name = "admin",
-            };
-            await _roleManager.CreateAsync(role);
+                await _roleManager.CreateAsync(new Role
+                {
+                    Name = roleName,
+                });
+            }
         }
 
         if (!_userManager.Users.AsNoTracking().Any(u => u.UserName.Equals("admin")))
@@ -37,7 +41,8 @@ public class SeedDataBase : ISeedDataBase
             {
                 UserName = "admin",
                 Email = "admin@site.com",
-                PhoneNumberConfirmed = true
+                PhoneNumberConfirmed = true,
+                IsActive = true
             };
 
             await  _userManager.CreateAsync(user, "qw123321");