feat(auth): replace TOTP with phone-first login

Tiku.Application/Auth/AuthContracts.cs

@@ -52,10 +52,6 @@ public enum AuthenticationStatus
 {
     [JsonStringEnumMemberName("authenticated")]
     Authenticated,
-    [JsonStringEnumMemberName("mfa_required")]
-    MfaRequired,
-    [JsonStringEnumMemberName("mfa_enrollment_required")]
-    MfaEnrollmentRequired,
     [JsonStringEnumMemberName("password_change_required")]
     PasswordChangeRequired
 }
@@ -97,24 +93,12 @@ public sealed record RefreshSessionRequest(
 public sealed record LogoutSessionRequest(
     string RefreshToken);
 
-public sealed record MfaChallengeRequest(
-    string ChallengeToken,
-    string? Code,
-    string? IpAddress,
-    string? UserAgent);
-
 public sealed record PasswordChangeChallengeRequest(
     string ChallengeToken,
     string NewPassword,
     string? IpAddress,
     string? UserAgent);
 
-public sealed record MfaSetupResult(string SharedKey, string AuthenticatorUri);
-
-public sealed record MfaConfirmResult(
-    AuthenticationResult Authentication,
-    IReadOnlyList<string> RecoveryCodes);
-
 public sealed record SmsSendResult(
     Guid VerificationId,
     DateTimeOffset ExpiresAt);

Tiku.Application/Auth/IAuthService.cs

@@ -28,18 +28,6 @@ public interface IAuthService
 
     Task LogoutAllAsync(Guid userId, CancellationToken cancellationToken = default);
 
-    Task<MfaSetupResult> SetupTotpAsync(
-        MfaChallengeRequest request,
-        CancellationToken cancellationToken = default);
-
-    Task<MfaConfirmResult> ConfirmTotpAsync(
-        MfaChallengeRequest request,
-        CancellationToken cancellationToken = default);
-
-    Task<AuthenticationResult> VerifyTotpAsync(
-        MfaChallengeRequest request,
-        CancellationToken cancellationToken = default);
-
     Task<AuthenticationResult> ChangeRequiredPasswordAsync(
         PasswordChangeChallengeRequest request,
         CancellationToken cancellationToken = default);

Tiku.Application/Auth/IAuthSessionStore.cs

@@ -38,12 +38,11 @@ public sealed record AuthSessionIssueRequest(
     AuthRealm Realm,
     Guid? TenantId,
     string Provider,
-    bool MfaSatisfied,
     string? IpAddress,
     string? UserAgent,
     Guid? TokenFamilyId = null,
     Guid? ParentSessionId = null);
 
-public sealed record AuthSessionValidationResult(Guid UserId, AuthRealm Realm, Guid? TenantId, bool MfaSatisfied);
+public sealed record AuthSessionValidationResult(Guid UserId, AuthRealm Realm, Guid? TenantId);
 
 public readonly record struct RefreshTokenLocator(AuthRealm Realm, Guid? TenantId, Guid SessionId);

Tiku.Application/Auth/ITokenService.cs

@@ -10,6 +10,5 @@ public interface ITokenService
         string? phone,
         string? email,
         AuthRealm realm,
-        Guid? tenantId,
-        bool mfaSatisfied);
+        Guid? tenantId);
 }