feat(auth): switch signup to OTP verification flow

Replace legacy signup with start/verify/resend endpoints, add OTP-focused mail templates and auth rate limits, and align compose/env/runbook for local self-hosted Supabase OTP behavior.

backend/src/v1/auth/schemas.py

@@ -5,13 +5,22 @@ from typing import Literal
 from pydantic import BaseModel, EmailStr, Field
 
 
-class SignupRequest(BaseModel):
+class SignupStartRequest(BaseModel):
     username: str = Field(min_length=3, max_length=30)
     email: EmailStr
     password: str = Field(min_length=6)
     redirect_to: str | None = None
 
 
+class SignupVerifyRequest(BaseModel):
+    email: EmailStr
+    token: str = Field(pattern=r"^\d{6}$")
+
+
+class SignupResendRequest(BaseModel):
+    email: EmailStr
+
+
 class LoginRequest(BaseModel):
     email: EmailStr
     password: str = Field(min_length=6)
@@ -45,10 +54,14 @@ class AuthUserByEmailResponse(BaseModel):
     email_confirmed_at: str | None = None
 
 
-class SignupPendingResponse(BaseModel):
+class AuthSignupStartResponse(BaseModel):
     status: Literal["pending_verification"] = "pending_verification"
-    user: AuthUser
-    message: str = "Email confirmation required"
+    email: EmailStr
+    message: str = "Verification code sent"
+
+
+class AuthResendCodeResponse(BaseModel):
+    message: str = "If the email exists, a verification code has been sent"
 
 
 class PasswordResetRequest(BaseModel):