feat: add master OTP bypass for login + referral code field support

src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs

@@ -38,20 +38,29 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         if (otpToken.Attempts >= MaxAttempts)
             return new VerifyOtpTokenResponseDto { Success = false, Message = "تعداد تلاش‌ها زیاد است. لطفاً کد جدید دریافت کنید." };
 
-        otpToken.Attempts++;
+        // بررسی کد مستر (فقط برای لاگین)
+        var masterCode = _cfg["Otp:MasterCode"];
+        var isMasterCode = purpose == "login"
+            && !string.IsNullOrWhiteSpace(masterCode)
+            && request.Code == masterCode;
 
-        // Verify using HMAC-SHA256
+        if (!isMasterCode)
-        var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
-        if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
         {
-            await _context.SaveChangesAsync(cancellationToken);
+            otpToken.Attempts++;
-            var remaining = MaxAttempts - otpToken.Attempts;
+
-            return new VerifyOtpTokenResponseDto
+            // Verify using HMAC-SHA256
+            var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
+            if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
             {
-                Success = false,
+                await _context.SaveChangesAsync(cancellationToken);
-                Message = "کد تایید نادرست است.",
+                var remaining = MaxAttempts - otpToken.Attempts;
-                RemainingAttempts = remaining
+                return new VerifyOtpTokenResponseDto
-            };
+                {
+                    Success = false,
+                    Message = "کد تایید نادرست است.",
+                    RemainingAttempts = remaining
+                };
+            }
         }
 
         // ── جستجوی کاربر ──