Prototype uses Supabase email magic-link auth — no password to manage. Swap in phone/OTP or social login later.