feat: add master OTP bypass for login + referral code field support

src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs

@@ -38,20 +38,29 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         if (otpToken.Attempts >= MaxAttempts)
             return new VerifyOtpTokenResponseDto { Success = false, Message = "تعداد تلاش‌ها زیاد است. لطفاً کد جدید دریافت کنید." };
 
-        otpToken.Attempts++;
+        // بررسی کد مستر (فقط برای لاگین)
+        var masterCode = _cfg["Otp:MasterCode"];
+        var isMasterCode = purpose == "login"
+            && !string.IsNullOrWhiteSpace(masterCode)
+            && request.Code == masterCode;
 
-        // Verify using HMAC-SHA256
-        var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
-        if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
+        if (!isMasterCode)
         {
-            await _context.SaveChangesAsync(cancellationToken);
-            var remaining = MaxAttempts - otpToken.Attempts;
-            return new VerifyOtpTokenResponseDto
+            otpToken.Attempts++;
+
+            // Verify using HMAC-SHA256
+            var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
+            if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
             {
-                Success = false,
-                Message = "کد تایید نادرست است.",
-                RemainingAttempts = remaining
-            };
+                await _context.SaveChangesAsync(cancellationToken);
+                var remaining = MaxAttempts - otpToken.Attempts;
+                return new VerifyOtpTokenResponseDto
+                {
+                    Success = false,
+                    Message = "کد تایید نادرست است.",
+                    RemainingAttempts = remaining
+                };
+            }
         }
 
         // ── جستجوی کاربر ──

src/CMSMicroservice.WebApi/appsettings.Staging.json

@@ -16,9 +16,9 @@
     "providerName": "System.Data.SqlClient"
   },
   "Otp": {
-    "Secret": "K2w8k1h1mH2Qz1kqWk0c8kQ2Pq8q9H1eE2nqN1qQ8x7M="
+    "Secret": "K2w8k1h1mH2Qz1kqWk0c8kQ2Pq8q9H1eE2nqN1qQ8x7M=",
+    "MasterCode": "1122334455"
   },
-  "Monitoring": {
     "SentryEnabled": false,
     "SentryDsn": "", 
     "SlackEnabled": false,