- Adds exponential backoff for Phone MFA SMS delivery, replacing static rate limits with progressive delays up to 32 minutes.
- Mitigates SMS pumping and toll‑fraud attacks while preserving usability for legitimate users.
- Logs throttled attempts as `limit_phone` events and automatically decays cooldowns after inactivity.