fix(dimentorin): verify-email validates OTP before activating user

- new app_otp_cache table + OtpCache entity (ResourceEnum::OtpCache)
- PostgresOtpRepository upsert/find/delete keyed by email
- register/resend persist otp_hash+expiry after email sent (no orphan OTP)
- verify_email validates via OtpManager::validate_otp_hash, single-use delete
- 8 unit tests pass, e2e verified: wrong OTP 400, correct OTP 200

imphnen-entities/src/seaorm/common/mod.rs

@@ -3,6 +3,7 @@ pub mod audit_log;
 pub mod enum_impls;
 pub mod enums;
 pub mod events;
+pub mod otp_cache;
 pub mod rate_limit;
 pub mod roadmap_items;
 pub mod testimonials;

imphnen-entities/src/seaorm/common/otp_cache.rs

@@ -0,0 +1,31 @@
+use chrono::{DateTime, Utc};
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, DeriveEntityModel)]
+#[sea_orm(table_name = "app_otp_cache")]
+pub struct Model {
+	#[sea_orm(primary_key, default = "gen_random_uuid()", auto_increment = false)]
+	pub id: Uuid,
+
+	#[sea_orm(unique, not_null)]
+	pub email: String,
+
+	#[sea_orm(not_null)]
+	pub otp_hash: String,
+
+	#[sea_orm(not_null)]
+	pub expires_at: DateTime<Utc>,
+
+	#[sea_orm(not_null, default = "now()")]
+	pub created_at: DateTime<Utc>,
+
+	#[sea_orm(not_null, default = "now()")]
+	pub updated_at: DateTime<Utc>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}