SMS → Backend Event API

You are integrating verify.mn — a Mongolia-only Mobile-Originated (MO) SMS phone
verification API — into this codebase. Add a function `verifyPhone(phone: string): Promise<boolean>`
(adapt to the codebase's language and style) that returns true only after the user's phone is confirmed.

## How verification works
1. Backend calls POST https://api.verify.mn/sessions with phone + SMS text + callback URL.
2. API returns sessionId, smsUri (sms:144773?body=...), displayInstruction (Mongolian text to
   show the user), and expiresAt (300s TTL).
3. Show displayInstruction to the user. On mobile, offer smsUri as a tap-to-open link.
4. User sends the SMS from their phone to shortcode 144773.
5. On receipt, verify.mn fires a GET request to the callback URL (no body, no signature).
   Treat this as a "check now" notification — do NOT trust it on its own.
6. On receiving the callback (or while polling every ~3s), call
   GET https://api.verify.mn/sessions/{sessionId} and confirm sessionStatus === "VERIFIED".
7. If expiresAt passes without VERIFIED, treat as failure.

## Endpoints

### POST /sessions   (auth required)
Headers:  Authorization: Bearer <VERIFY_MN_API_KEY>  (read from env, never hardcode)
          Content-Type: application/json
Body:     { "phone": "<8-16 digits>", "text": "<1-120 chars>", "callback": "<https URL>" }
Response: { sessionId, phone, shortcode: "144773", text, smsUri, displayInstruction, expiresAt }
Errors:   400 validation, 401 bad key, 500 server

### GET /sessions/{sessionId}   (no auth)
Response: { sessionId, phone, sessionStatus: PENDING|VERIFIED|EXPIRED,
            callbackStatus: PENDING|SENT|FAILED, verifiedAt, expiresAt }
Errors:   404 not found, 429 too many requests (same sessionId polled faster than
          every 2s), 500 server

### Callback  (verify.mn -> developer)
Method: GET, no body, no HMAC. Retries up to 5x on non-200. Must return 200 fast.
Purpose: wake-up signal. Always re-check via GET /sessions/{sessionId}.

## Requirements
- Read VERIFY_MN_API_KEY from env. Fail loudly if missing.
- Generate a random 4-6 digit numeric code as SMS text (e.g. "482916") per session — do not reuse.
- Store sessionId linked to the user/order record being verified.
- On callback receipt, look up the session, call GET /sessions/{sessionId}, mark verified.
- If no callback is available, poll GET /sessions/{sessionId} until VERIFIED or expiresAt,
  with a hard timeout. **Minimum polling interval is 3 seconds** — faster than 2s gets 429.
  Do not implement aggressive retry loops on 429; back off to >= 3s.
- Use the project's existing HTTP client and logging. Do not add new dependencies unless required.
- Never log the API key.

## Pricing (context only, no code needed)
Per verified phone: user pays 150₮ to operator; developer earns 40₮ (credited to the verify.mn
dashboard). No setup fee, no monthly fee.

## Done when
- verifyPhone(phone) returns true for a phone that sent the correct SMS, false otherwise.
- VERIFY_MN_API_KEY is documented in the project's env example file.
- Callback route (if used) returns 200 quickly and triggers status check.
- Test covers: PENDING -> VERIFIED, EXPIRED timeout, 401 on bad key.