feat(auth): switch signup to OTP verification flow

Replace legacy signup with start/verify/resend endpoints, add OTP-focused mail templates and auth rate limits, and align compose/env/runbook for local self-hosted Supabase OTP behavior.

backend/src/v1/auth/service.py

@@ -3,16 +3,30 @@ from __future__ import annotations
 from typing import Protocol
 
 from v1.auth.schemas import (
+    AuthResendCodeResponse,
+    AuthSignupStartResponse,
     AuthTokenResponse,
     AuthUserByEmailResponse,
     LoginRequest,
     RefreshRequest,
-    SignupRequest,
+    SignupResendRequest,
+    SignupStartRequest,
+    SignupVerifyRequest,
 )
 
 
 class AuthServiceGateway(Protocol):
-    async def signup(self, request: SignupRequest) -> AuthTokenResponse:
+    async def signup_start(
+        self, request: SignupStartRequest
+    ) -> AuthSignupStartResponse:
+        raise NotImplementedError
+
+    async def signup_verify(self, request: SignupVerifyRequest) -> AuthTokenResponse:
+        raise NotImplementedError
+
+    async def signup_resend(
+        self, request: SignupResendRequest
+    ) -> AuthResendCodeResponse:
         raise NotImplementedError
 
     async def login(self, request: LoginRequest) -> AuthTokenResponse:
@@ -34,8 +48,18 @@ class AuthService:
     def __init__(self, gateway: AuthServiceGateway) -> None:
         self._gateway = gateway
 
-    async def signup(self, request: SignupRequest) -> AuthTokenResponse:
-        return await self._gateway.signup(request)
+    async def signup_start(
+        self, request: SignupStartRequest
+    ) -> AuthSignupStartResponse:
+        return await self._gateway.signup_start(request)
+
+    async def signup_verify(self, request: SignupVerifyRequest) -> AuthTokenResponse:
+        return await self._gateway.signup_verify(request)
+
+    async def signup_resend(
+        self, request: SignupResendRequest
+    ) -> AuthResendCodeResponse:
+        return await self._gateway.signup_resend(request)
 
     async def login(self, request: LoginRequest) -> AuthTokenResponse:
         return await self._gateway.login(request)