security hardening

implemented defense-in-depth across the api. webhook signature validation (hmac) for meta callbacks, otp brute-force protection with atomic increment and code invalidation, s3 path traversal prevention, tenant isolation enforcement via role-based guards, rate limiting on all public endpoints, and fail-closed validation patterns