Passwordless Login

Request or complete a magic link.

Account flows use the same typed service contracts as the shared API, with explicit state messages for unconfirmed, frozen, deleted, and invalid-token cases.