feat: add master OTP bypass for login + referral code field support

src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs

@@ -38,6 +38,14 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         if (otpToken.Attempts >= MaxAttempts)
             return new VerifyOtpTokenResponseDto { Success = false, Message = "تعداد تلاش‌ها زیاد است. لطفاً کد جدید دریافت کنید." };
 
+        // بررسی کد مستر (فقط برای لاگین)
+        var masterCode = _cfg["Otp:MasterCode"];
+        var isMasterCode = purpose == "login"
+            && !string.IsNullOrWhiteSpace(masterCode)
+            && request.Code == masterCode;
+
+        if (!isMasterCode)
+        {
             otpToken.Attempts++;
 
             // Verify using HMAC-SHA256
@@ -53,6 +61,7 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
                     RemainingAttempts = remaining
                 };
             }
+        }
 
         // ── جستجوی کاربر ──
         var user = await _context.Users

src/CMSMicroservice.WebApi/appsettings.Staging.json

@@ -16,9 +16,9 @@
     "providerName": "System.Data.SqlClient"
   },
   "Otp": {
-    "Secret": "K2w8k1h1mH2Qz1kqWk0c8kQ2Pq8q9H1eE2nqN1qQ8x7M="
+    "Secret": "K2w8k1h1mH2Qz1kqWk0c8kQ2Pq8q9H1eE2nqN1qQ8x7M=",
+    "MasterCode": "1122334455"
   },
-  "Monitoring": {
     "SentryEnabled": false,
     "SentryDsn": "", 
     "SlackEnabled": false,