127e0f8912
- Login: identify → password/otp now push() history (was replace()), so Back returns to the email screen instead of leaving to /register. - Login: in Shell mode the OTP screen no longer shows an email/SMS toggle — the channel is fixed by how you signed in, so email sign-in never shows a stray SMS option. - Login: hide phone (SMS) sign-in while OTP is mocked — a faked login code can't mint a session (AuthGate would bounce), so it can't work without SMS. Email OTP + password + Google stay real and working. - Register: add Back buttons (email screen → sign in; profile screen → email). - Share MOCK_OTP/DEMO_OTP via @/lib/otp.