Sms Send

Mint + send a 6-digit OTP to the caller's phone.

Rate limiting:

• Per phone: 1 OTP / 60s. Repeat sends within the window reuse the existing code (we DON'T burn Aliyun quota on retries) and return the same {"sent": true} response so the client can't probe "is this number registered" by timing.
• Per IP: tracked via the phone_otp_codes.ip column; same 60s. Stops a single attacker from sweeping codes across N phones.

Returns

200 {"sent": true} on success (also when the per-phone cooldown short-circuited — see above). 400 if phone fails E.164 +86 validation. 503 if Aliyun SMS isn't configured server-side. 502 if Aliyun returned a non-OK Code (network / template / quota).