// Login is passwordless: users get a magic link by email. We dropped passwords
// entirely after the 2024 credential-stuffing incident — fewer secrets to leak.
export function sendMagicLink(email) { /* ... */ }
