feat: harden SaaS authentication and authorization

Tiku.Application/Auth/SmsSecurityOptions.cs

@@ -0,0 +1,23 @@
+namespace Tiku.Application.Auth;
+
+public sealed class SmsSecurityOptions
+{
+    public const string SectionName = "Authentication:Sms";
+
+    public string CodePepper { get; set; } = string.Empty;
+    public int MaxVerificationAttempts { get; set; } = 5;
+    public int TenantRequestsPerHour { get; set; } = 100;
+    public int PhoneRequestsPerHour { get; set; } = 5;
+    public int IpRequestsPerHour { get; set; } = 20;
+    public int DeviceRequestsPerHour { get; set; } = 10;
+
+    public static bool BeValid(SmsSecurityOptions options)
+    {
+        return options.CodePepper.Length >= 32 &&
+               options.MaxVerificationAttempts == 5 &&
+               options.TenantRequestsPerHour > 0 &&
+               options.PhoneRequestsPerHour > 0 &&
+               options.IpRequestsPerHour > 0 &&
+               options.DeviceRequestsPerHour > 0;
+    }
+}