backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/Tests/Baya.Test.Api/BayaApiFactory.cs

@@ -0,0 +1,75 @@
+using Baya.Infrastructure.Identity.Identity.SeedDatabaseService;
+using Baya.Infrastructure.Persistence;
+using Baya.Infrastructure.Persistence.Interceptors;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Hosting;
+
+namespace Baya.Test.Api;
+
+/// <summary>
+/// Boots the whole API (Program.cs wiring: envelope filters, JWE auth, rate limiter, Mediator) in the
+/// "Testing" environment over an isolated in-memory SQLite database. Program skips SQL Server
+/// migrations/seeding for this environment; the factory does EnsureCreated + the role/admin seed.
+/// Use one factory per test class — the rate limiter is per-host, so a fresh host keeps each class
+/// inside the OTP/auth per-IP budgets.
+/// </summary>
+public sealed class BayaApiFactory : WebApplicationFactory<Program>
+{
+    // A named shared-cache in-memory database (kept alive by this connection) instead of a single
+    // shared SqliteConnection instance: request scopes and hosted services open their own
+    // connections, so nothing initializes one connection concurrently.
+    private readonly string _connectionString =
+        $"Data Source={Guid.NewGuid():N};Mode=Memory;Cache=Shared";
+
+    private readonly SqliteConnection _keepAlive;
+
+    public BayaApiFactory()
+    {
+        _keepAlive = new SqliteConnection(_connectionString);
+        _keepAlive.Open();
+    }
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseEnvironment("Testing");
+
+        builder.ConfigureServices(services =>
+        {
+            // Swap the SQL Server DbContext for in-memory SQLite. EF 8+ keeps AddDbContext's
+            // option lambda in IDbContextOptionsConfiguration — it must go too, or both providers
+            // end up configured on the same options.
+            services.RemoveAll(typeof(IDbContextOptionsConfiguration<ApplicationDbContext>));
+            services.RemoveAll(typeof(DbContextOptions<ApplicationDbContext>));
+
+            services.AddDbContext<ApplicationDbContext>((serviceProvider, options) =>
+            {
+                options
+                    .UseSqlite(_connectionString)
+                    .AddInterceptors(serviceProvider.GetRequiredService<AuditFieldInterceptor>());
+            });
+        });
+    }
+
+    protected override IHost CreateHost(IHostBuilder builder)
+    {
+        var host = base.CreateHost(builder);
+
+        using var scope = host.Services.CreateScope();
+        scope.ServiceProvider.GetRequiredService<ApplicationDbContext>().Database.EnsureCreated();
+        scope.ServiceProvider.GetRequiredService<ISeedDataBase>().Seed().GetAwaiter().GetResult();
+
+        return host;
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+        _keepAlive.Dispose();
+    }
+}