feat: harden SaaS authentication and authorization

Tiku.Api/Options/AuthRateLimitOptions.cs

@@ -0,0 +1,33 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Tiku.Api.Options;
+
+public sealed class AuthRateLimitOptions
+{
+    public const string SectionName = "RateLimiting:Authentication";
+
+    [Range(1, 100)]
+    public int PasswordPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int PasswordWindowSeconds { get; set; } = 900;
+
+    [Range(1, 100)]
+    public int SmsPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int SmsWindowSeconds { get; set; } = 300;
+
+    [Range(1, 100)]
+    public int MfaPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int MfaWindowSeconds { get; set; } = 300;
+}
+
+public static class AuthRateLimitPolicies
+{
+    public const string Password = "auth-password";
+    public const string Sms = "auth-sms";
+    public const string Mfa = "auth-mfa";
+}