feature/release 0

[chintakjoshi]

What shipped:

• app/config.py — three new classes: SmsSettings, MfaRateLimits, MfaSettings; attached as Settings.mfa; three new production guards (mfa.sms.provider != "local", mfa.phone_encryption_key required, mfa.phone_lookup_hash_key required).
• tests/unit/test_config_mfa_production_guard.py — 28 new tests covering defaults, range validation, provider literal, production guard paths.
• tests/unit/test_config_production_hardening.py and tests/unit/test_app_production_hardening.py — minimal updates to supply the new required MFA keys when constructing production settings.
• .env-sample — new MFA__* block with commented-out production-required keys