otp-attempt-limiting

[BigJohn-dev]

CLoses #277 — OTP Attempt Limiting

Prevents brute-force attacks on OTP recovery by capping failed verification attempts at 5.

Changes

• schema.ts — Added is_valid boolean column to email_verifications table (default true).
• otp.service.ts — New service with verifyOtp and createOtpRecord helpers.

Behaviour

• Each wrong OTP increments attempts and returns the remaining count.
• On the 5th wrong guess, is_valid is set to false and a TooManyRequestsError (429) is thrown.
• All subsequent attempts against a locked session are rejected immediately — no hash comparison is performed.
• A correct OTP sets verified = true and is_valid = false (consumed).

Migration required — run pnpm drizzle-kit generate && pnpm drizzle-kit migrate to add the is_valid column.

[codeZe-us]

@BigJohn-dev Please review this PR, it looks incomplete