fix(dimentorin): verify-email validates OTP before activating user

- new app_otp_cache table + OtpCache entity (ResourceEnum::OtpCache)
- PostgresOtpRepository upsert/find/delete keyed by email
- register/resend persist otp_hash+expiry after email sent (no orphan OTP)
- verify_email validates via OtpManager::validate_otp_hash, single-use delete
- 8 unit tests pass, e2e verified: wrong OTP 400, correct OTP 200

imphnen-iam/src/auth/infrastructure/http/routes.rs

@@ -4,6 +4,7 @@ use super::handlers::{
 };
 use crate::auth::application::AuthServiceImpl;
 use crate::auth::domain::AuthService;
+use crate::auth::infrastructure::PostgresOtpRepository;
 use crate::roles::infrastructure::persistence::PostgresRoleRepository;
 use crate::users::infrastructure::persistence::PostgresUserRepository;
 use axum::{Extension, Router, routing::post};
@@ -18,8 +19,11 @@ pub fn auth_public_routes(_db: DatabaseConnection, state: Arc<AppState>) -> Rout
 	let role_repo = Arc::new(PostgresRoleRepository::new(
 		state.postgres_connection.conn.clone(),
 	));
+	let otp_repo = Arc::new(PostgresOtpRepository::new(
+		state.postgres_connection.conn.clone(),
+	));
 	let auth_service: Arc<dyn AuthService> =
-		Arc::new(AuthServiceImpl::new(user_repo, role_repo));
+		Arc::new(AuthServiceImpl::new(user_repo, role_repo, otp_repo));
 	Router::new()
 		.route("/auth/login", post(post_login))
 		.route("/auth/login-mentor", post(post_login_mentor))