Server-only key the typed code is HMAC'd under before it is stored. It must never reach a client or a
session row: the session owner can read their own Config, and without this key a six-digit code
hash cannot be reversed offline. See HashVerificationCode.
Master switch. Must be false when no VerificationSettings.CodeHashKey is available.
Base policy layer from server config.
Base URL for the emailed link, no trailing slash; undefined ⇒ the feature cannot send.
Limits applied in memory (0 disables a limit).
Settings the workflow reads (resolved from server config by the service).