feat(auth): mobile-only register/login with OTP verification

- Register and login by mobile number; email is now an optional
  contact field only (never used to authenticate)
- After registration, the phone is verified via a 6-digit SMS code
- Login supports both password and one-time-code (OTP) methods
- Phone OTP delivered via Kavenegar (verify/lookup); API key in env
- Account page: edit name/optional email, change password, and
  change mobile number with OTP re-verification
- Codes are hashed, expire in 5m, capped at 5 attempts, rate-limited
- Seed gives the admin a verified phone so mobile login still works

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/store.ts

@@ -4,14 +4,44 @@ import { create } from 'zustand';
 import api from '@/lib/api';
 import type { User, AuthResponse } from '@/types';
 
+export interface RegisterData {
+  phone: string;
+  password: string;
+  firstName: string;
+  lastName: string;
+  email?: string;
+}
+
+/** Either the user is fully authenticated, or a phone OTP is required next. */
+export type AuthResult =
+  | { status: 'authenticated' }
+  | { status: 'verify'; phone: string };
+
+interface VerificationRequired {
+  requiresVerification: true;
+  phone: string;
+}
+
 interface AuthState {
   user: User | null;
   isLoading: boolean;
   isAuthenticated: boolean;
-  login: (email: string, password: string) => Promise<void>;
-  register: (data: { email: string; password: string; firstName: string; lastName: string }) => Promise<void>;
+  /** Password login by mobile. May require OTP verification. */
+  login: (phone: string, password: string) => Promise<AuthResult>;
+  /** Register by mobile — always returns a verify step. */
+  register: (data: RegisterData) => Promise<{ phone: string }>;
+  /** Send a one-time login code to a mobile number. */
+  requestOtp: (phone: string) => Promise<void>;
+  /** Verify a one-time code (completes registration or OTP login). */
+  verifyOtp: (phone: string, code: string) => Promise<void>;
   logout: () => void;
   loadUser: () => Promise<void>;
+  setUser: (user: User) => void;
+}
+
+function persistAuth(data: AuthResponse) {
+  localStorage.setItem('accessToken', data.accessToken);
+  localStorage.setItem('refreshToken', data.refreshToken);
 }
 
 export const useAuthStore = create<AuthState>((set) => ({
@@ -19,17 +49,31 @@ export const useAuthStore = create<AuthState>((set) => ({
   isLoading: true,
   isAuthenticated: false,
 
-  login: async (email, password) => {
-    const { data } = await api.post<AuthResponse>('/auth/login', { email, password });
-    localStorage.setItem('accessToken', data.accessToken);
-    localStorage.setItem('refreshToken', data.refreshToken);
+  login: async (phone, password) => {
+    const { data } = await api.post<AuthResponse | VerificationRequired>(
+      '/auth/login',
+      { phone, password },
+    );
+    if ('requiresVerification' in data) {
+      return { status: 'verify', phone: data.phone };
+    }
+    persistAuth(data);
     set({ user: data.user, isAuthenticated: true });
+    return { status: 'authenticated' };
   },
 
   register: async (registerData) => {
-    const { data } = await api.post<AuthResponse>('/auth/register', registerData);
-    localStorage.setItem('accessToken', data.accessToken);
-    localStorage.setItem('refreshToken', data.refreshToken);
+    const { data } = await api.post<VerificationRequired>('/auth/register', registerData);
+    return { phone: data.phone };
+  },
+
+  requestOtp: async (phone) => {
+    await api.post('/auth/otp/request', { phone });
+  },
+
+  verifyOtp: async (phone, code) => {
+    const { data } = await api.post<AuthResponse>('/auth/otp/verify', { phone, code });
+    persistAuth(data);
     set({ user: data.user, isAuthenticated: true });
   },
 
@@ -52,4 +96,6 @@ export const useAuthStore = create<AuthState>((set) => ({
       set({ user: null, isAuthenticated: false, isLoading: false });
     }
   },
+
+  setUser: (user) => set({ user }),
 }));