- Single unified flow: phone → SMS code → (if new: enter name) - POST /api/auth/complete — verifies OTP, logs in or registers - Removed password from login/register completely - New users get random password_hash (not used for auth) - Removed password change section from ProfileModal Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>