feat(auth): replace TOTP with phone-first login

Tiku.Infrastructure/Auth/TokenService.cs

@@ -17,8 +17,7 @@ public sealed class TokenService(IOptions<JwtOptions> options, IJwtKeyRing keyRi
         string? phone,
         string? email,
         AuthRealm realm,
-        Guid? tenantId,
-        bool mfaSatisfied)
+        Guid? tenantId)
     {
         var expiresAt = DateTimeOffset.UtcNow.AddMinutes(options.AccessTokenMinutes);
         var claims = new List<Claim>
@@ -35,11 +34,6 @@ public sealed class TokenService(IOptions<JwtOptions> options, IJwtKeyRing keyRi
             claims.Add(new Claim(TikuClaimTypes.TenantId, tenantId.Value.ToString()));
         }
 
-        if (mfaSatisfied)
-        {
-            claims.Add(new Claim(TikuClaimTypes.Mfa, "mfa"));
-        }
-
         if (!string.IsNullOrWhiteSpace(phone))
         {
             claims.Add(new Claim(TikuClaimTypes.Phone, phone));