feat(auth): replace TOTP with phone-first login

Tiku.Infrastructure/Auth/LetterAndDigitPasswordValidator.cs

@@ -0,0 +1,24 @@
+using Microsoft.AspNetCore.Identity;
+
+namespace Tiku.Infrastructure.Auth;
+
+public sealed class LetterAndDigitPasswordValidator<TUser> : IPasswordValidator<TUser>
+    where TUser : class
+{
+    public Task<IdentityResult> ValidateAsync(
+        UserManager<TUser> manager,
+        TUser user,
+        string? password)
+    {
+        var valid = password is { Length: >= 8 } &&
+                    password.Any(char.IsLetter) &&
+                    password.Any(char.IsDigit);
+        return Task.FromResult(valid
+            ? IdentityResult.Success
+            : IdentityResult.Failed(new IdentityError
+            {
+                Code = "PasswordRequiresLetterAndDigit",
+                Description = "Password must be at least 8 characters and contain both letters and digits."
+            }));
+    }
+}