feat(auth): Implement Email OTP Verification

[ademboukabes]

What's this PR do

Implements an asynchronous Email OTP Verification flow for mobile user registrations to prevent bot abuse and keep the database clean of unverified accounts.

Architecture & Technical Decisions

• Redis Caching: Pending users are cached in Redis (10-min TTL) instead of the PostgreSQL users table.
• Event-Driven: The API publishes an email.send_otp event to NATS to avoid blocking the main thread.
• Email Worker: A new background worker consumes the event and sends the OTP via the Resend API using standard urllib.
• Verification: The verify endpoint validates the OTP, permanently creates the user, and returns the JWT tokens.

Changes

• Endpoints:
  • POST /mobile/auth/register (Returns pending_verification)
  • POST /mobile/auth/register/verify (Validates OTP and creates user)
• Worker: Added app/worker/email_worker/main.py.
• Infrastructure: Added EmailSender module for Resend API. Added email-worker to Docker Compose files.
• Tests: Added unit tests in tests/unit/test_auth_email_otp.py.

Environment Variables

RESEND_API_KEY=re_your_api_key_here
EMAIL_FROM=onboarding@resend.dev