v0.2.3

What's Changed

• refactor: make email be the primary verification method and allow it to be the only verfication method by @Bccorb in #42
• Otp sanatization by @Bccorb in #43
• docs: keep code comments minimal by @Bccorb in #45
• fix(config): make LOGIN_METHODS (and env-mapped config) authoritative over seeded defaults by @Bccorb in #48
• fix(oauth): apply provider schema defaults from OAUTH_PROVIDERS env by @Bccorb in #50
• ci: run seamless verify conformance on PRs by @Bccorb in #51
• chore: update version and changelog by @github-actions[bot] in #44
• fix(registration): rate limit the register endpoint by @Bccorb in #52
• docs: add unified configuration reference by @Bccorb in #54
• feat(openapi): mark GET /logout as deprecated by @Bccorb in #55
• docs: define trusted server adapter and add deployment topology by @Bccorb in #56
• docs: add direct HTTP quickstart by @Bccorb in #57
• fix(config): validate system_config on the runtime read path by @Bccorb in #67
• fix(redaction): redact otp/verificationToken query params and document policy by @Bccorb in #68
• chore(admin): remove stale session-DTO TODO by @Bccorb in #73
• test: restore skipped connectToDb tests by @Bccorb in #69
• fix(metrics): validate metrics date-range query params by @Bccorb in #70
• docs: expand contributor and integration guides by @Bccorb in #71
• refactor(refresh): remove the legacy refresh-token fallback scan by @Bccorb in #72
• chore: update version and changelog by @github-actions[bot] in #53

Full Changelog: v0.2.1...v0.2.3