feat(verification): hashed one-time codes with attempt counting

[roncodes]

PR 1 of the customer tracking pages refactor. It adds hashed one-time codes to VerificationCode, for flows where a leaked verification_codes table must not give away live codes.

Why

VerificationCode stores codes in plain text and counts no attempts. The new public tracking page sends recipients a 6-digit code to unlock delivery details, so it needs codes that are stored hashed and can't be guessed indefinitely.

Changes

• VerificationCode::issue($subject, $for, $options):
  • Stores hash_hmac('sha256', code, app.key), the same keying TwoFactorAuth uses.
  • Returns the plain code once, on the instance's plainCode property. It is never persisted.
  • Defaults to a 10-minute expiry and an active status. meta is merged, and hashed and attempts are recorded.
• check($plainCode, $maxAttempts = 3): returns valid, invalid, expired or locked. It compares with hash_equals, counts wrong attempts in meta, and locks the code on the last allowed attempt. It also checks plain codes made the old way.
• attemptsLeft() and hashCode().
• The creating hook now keeps a code that was already set, so issue() isn't overwritten. Codes made the old way still get a random one.

Existing generators (generateFor, generateEmailVerificationFor, generateSmsVerificationFor) and their callers don't change.

Tests

Three cases added to VerificationCodeModelTest:

• the stored value is the HMAC, not the plain code, and defaults and overrides apply;
• the attempt lifecycle: wrong, right, wrong, locked, then still locked with the right code;
• expiry at the boundary, and old-style plain codes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ab33100) to head (81b0245).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #289   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity      7931      7943   +12     
===========================================
  Files            438       438           
  Lines          25665     25698   +33     
===========================================
+ Hits           25665     25698   +33     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.