OTP (passwordless)

POST .../request-otp issues a one-time code for a passwordless login, backed by the _otps system collection — codes are SHA-256 hashed, not Argon2id, since a code is single-use and discarded within minutes. POST .../auth-with-otp completes the login with the code. This is the same second-factor mechanism MFA can require as its second step.