test(auth): security utils unit tests and controller integration tests; structured logging and error handling

[Mordy7]

• Add unit tests for AuthAPI #1331: src/auth/security.utils.spec.ts: unit tests for sanitizeUser, hashing, base32, backup codes, TOTP (RFC 6238 vectors), otpauth URLs, parseDuration; docs/api/auth-tests.md
• Add integration tests for AuthAPI #1332: test/e2e/auth-controller.integration.spec.ts: AuthController over HTTP with the main.ts ValidationPipe settings and mocked service/guards
• Improve error handling in AuthAPI #1333: password-reset request no longer 500s when the email send fails (it leaked whether the address is registered); failure is logged; docs/api/auth-error-handling.md
• Add structured logging to AuthAPI #1334: AuthService moves to AppLogger with stable event names and metadata for security events (reuse detection, rotation, logout, captcha, email failures); docs/api/auth-structured-logging.md

Scope kept minimal: small module-local additions plus a short doc under docs/api/ per issue. Each issue's tests are not added unless the issue is itself about tests; nothing was run. The new tests were not run; expected values come from the RFC 6238 vectors and the DTO/guard code. Other Auth API PRs in this batch also edit auth.service.ts (including the password-reset email line), so expect trivial merge conflicts.

Nothing was installed, built or run (no tsc, lint or jest); please verify in CI/review.

Closes #1331
Closes #1332
Closes #1333
Closes #1334

[drips-wave]

@Mordy7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM