feat: harden SaaS authentication and authorization

Tiku.Api/appsettings.json

@@ -47,7 +47,25 @@
     "Enabled": true,
     "PermitLimit": 600,
     "WindowSeconds": 60,
-    "QueueLimit": 0
+    "QueueLimit": 0,
+    "Authentication": {
+      "PasswordPermitLimit": 5,
+      "PasswordWindowSeconds": 900,
+      "SmsPermitLimit": 5,
+      "SmsWindowSeconds": 300,
+      "MfaPermitLimit": 5,
+      "MfaWindowSeconds": 300
+    }
+  },
+  "Authentication": {
+    "Sms": {
+      "CodePepper": "",
+      "MaxVerificationAttempts": 5,
+      "TenantRequestsPerHour": 100,
+      "PhoneRequestsPerHour": 5,
+      "IpRequestsPerHour": 20,
+      "DeviceRequestsPerHour": 10
+    }
   },
   "Storage": {
     "DefaultProvider": "aliyun_oss",
@@ -84,14 +102,20 @@
     "Jwt": {
       "Issuer": "tiku-backend",
       "Audience": "tiku-api",
-      "SigningKey": "",
-      "AccessTokenMinutes": 30,
-      "RefreshTokenDays": 30,
-      "ValidateSessions": true
+      "KeyId": "",
+      "PrivateKeyPem": "",
+      "PublicKeys": {},
+      "AccessTokenMinutes": 15,
+      "RefreshTokenDays": 30
     },
     "TenantSecrets": {
       "KeyId": "",
       "MasterKey": ""
+    },
+    "DataProtection": {
+      "ApplicationName": "Tiku.Api",
+      "CertificatePath": "",
+      "CertificatePassword": ""
     }
   },
   "AllowedHosts": "*"