- POST /api/auth/send-code — generates 4-digit OTP, sends SMS via SMSC.ru - Registration now requires SMS code verification (2-step flow) - Cooldown 60s between resends, 5 min expiry, max 5 attempts - Frontend: step 1 = enter phone → get code, step 2 = code + name + password - Large code input with tracking, countdown timer, resend button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>