fix(login): back-button nav, single OTP channel, register back buttons

- Login: identify → password/otp now push() history (was replace()), so Back
  returns to the email screen instead of leaving to /register.
- Login: in Shell mode the OTP screen no longer shows an email/SMS toggle —
  the channel is fixed by how you signed in, so email sign-in never shows a
  stray SMS option.
- Login: hide phone (SMS) sign-in while OTP is mocked — a faked login code
  can't mint a session (AuthGate would bounce), so it can't work without SMS.
  Email OTP + password + Google stay real and working.
- Register: add Back buttons (email screen → sign in; profile screen → email).
- Share MOCK_OTP/DEMO_OTP via @/lib/otp.

src/components/portal/register-flow.tsx

@@ -13,18 +13,13 @@ import {
 } from "./data";
 import { useAuth, useAppShell } from "@abe-kap/appshell-sdk/react";
 import { isShellConfigured } from "@/lib/appshell";
+import { MOCK_OTP, DEMO_OTP } from "@/lib/otp";
 
 type Addr = { line1?: string; line2?: string; city?: string; state?: string; postalCode?: string; country?: string; locality?: string };
 
 const STEPS = ["Account", "Verify", "Address"];
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
-// Demo fallback for phone OTP while the Twilio sender is down. When on, the Verify
-// step skips Supabase/Twilio and accepts a fixed code. Flip NEXT_PUBLIC_MOCK_OTP to
-// "false" (or remove it) to restore real SMS verification — no other change needed.
-const MOCK_OTP = process.env.NEXT_PUBLIC_MOCK_OTP === "true";
-const DEMO_OTP = "123456";
-
 export function RegisterFlow({ mode = "register" }: { mode?: "register" | "onboard" }) {
   // "onboard" = an already-authenticated OAuth (Google) user completing their CRM
   // profile: email is skipped (Google-verified), the auth account already exists so
@@ -214,6 +209,7 @@ function StepAccount(p: {
     const valid = EMAIL_RE.test(p.email);
     return (
       <div>
+        <StepBack onClick={p.toLogin} />
         <h1>Create your account</h1>
         <p className="sub">Enter your email to get started.</p>
         <div style={{ marginTop: 20 }}>
@@ -235,6 +231,9 @@ function StepAccount(p: {
 
   return (
     <div>
+      {/* Non-onboarding users can step back to the email screen; onboarding starts
+          here (email came from Google), so there's nothing to go back to. */}
+      {!p.onboard && <StepBack onClick={() => setPhase("sso")} />}
       <h1>Complete your profile</h1>
       <p className="sub">Tell us a bit about you to set up your account.</p>