fix(security): per-mobile OTP cap + refresh-token rotation (M6, M7)

M6: send-code rate-limited only per IP, so a victim's number could be
SMS-flooded from rotating IPs. Add a per-mobile bucket (same 5/hour policy)
keyed by the validated mobile.

M7: /oauth/token/refresh reused the presented refresh token verbatim (no
rotation) and never re-checked the user. The rotation infra already existed
(issueTokens mints a fresh refresh token) — the controller just discarded it.
Now revoke the presented token (single-use), issue a fresh pair, and reject a
suspended user (status != 1).

Regressions: tests/Auth/SendCodeMobileRateLimitTest,
tests/Auth/RefreshTokenRotationTest (both fail without the fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Auth/RefreshTokenRotationTest.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Tests\Auth;
+
+use App\Auth\Entity\User;
+use App\Auth\Service\TokenService;
+use App\Tests\ApiTestCase;
+
+/**
+ * Refresh tokens are single-use (rotated on every refresh) and a suspended user
+ * cannot refresh. Guards against replaying a stolen refresh token.
+ */
+class RefreshTokenRotationTest extends ApiTestCase
+{
+    private function issueRefresh(User $user): string
+    {
+        return static::getContainer()->get(TokenService::class)->issueTokens($user)['refresh_token'];
+    }
+
+    private function refresh(string $token): array
+    {
+        $this->client->request(
+            'POST',
+            '/oauth/token/refresh',
+            server: ['CONTENT_TYPE' => 'application/json'],
+            content: json_encode(['refresh_token' => $token]),
+        );
+
+        return json_decode($this->client->getResponse()->getContent(), true) ?? [];
+    }
+
+    public function testTokenIsRotatedAndOldOneRevoked(): void
+    {
+        $this->client->disableReboot();
+        $user = $this->createUser();
+
+        $old  = $this->issueRefresh($user);
+        $body = $this->refresh($old);
+        $this->assertSame(200, $this->responseCode());
+
+        $new = $body['refresh_token'];
+        $this->assertNotSame($old, $new, 'refresh token was not rotated');
+
+        // the old token is now single-use-spent → rejected
+        $this->refresh($old);
+        $this->assertSame(401, $this->responseCode());
+
+        // the new token still works
+        $this->refresh($new);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testSuspendedUserCannotRefresh(): void
+    {
+        $this->client->disableReboot();
+        $user = $this->createUser();
+        $token = $this->issueRefresh($user);
+
+        $user->setStatus(0);
+        $this->em->flush();
+
+        $this->refresh($token);
+        $this->assertSame(401, $this->responseCode());
+    }
+}

tests/Auth/SendCodeMobileRateLimitTest.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Tests\Auth;
+
+use App\Tests\ApiTestCase;
+
+/**
+ * send-code must cap requests per mobile number, not only per IP — otherwise a
+ * victim's number can be SMS-flooded from rotating IPs.
+ */
+class SendCodeMobileRateLimitTest extends ApiTestCase
+{
+    public function testPerMobileCapHoldsAcrossDifferentIps(): void
+    {
+        $this->client->disableReboot();
+        $mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
+
+        $statuses = [];
+        for ($i = 0; $i < 6; $i++) {
+            // each request from a different IP → the per-IP limiter never fires
+            $this->client->request(
+                'POST',
+                '/api/v1/user/send-code',
+                server: ['REMOTE_ADDR' => "10.20.30.$i", 'CONTENT_TYPE' => 'application/json'],
+                content: json_encode(['mobile' => $mobile]),
+            );
+            $statuses[] = $this->client->getResponse()->getStatusCode();
+        }
+
+        // send_code limit is 5/hour → the 6th for the same mobile is rejected
+        $this->assertSame(429, $statuses[5], 'per-mobile cap not enforced: ' . implode(',', $statuses));
+        $this->assertNotContains(429, array_slice($statuses, 0, 5));
+    }
+}