Auth and security

Choice:

• Sign-in and email verification are a 6-digit OTP on web and mobile. Invite links carry a token to sign-up or sign-in; there is no magic link and no accept-invite page.
• No ReCaptcha, of any kind, anywhere. Abuse defence is rate limiting plus App Check.
• App Check is enforced on callables (onZodCall). Public opt-outs: requestEmailOtp, verifyEmailOtp, joinWaitlist, listCaPublicReviews. No security rule reads App Check: a rule cannot see the token.
• A CA's share scope (year_max, account_ids) is enforced in Firestore rules. Dispute evidence storage is limited to the dispute's client and CA.
• Admin impersonation has no reason field; exit signs the admin back in place.

Why: OTP works across browsers and devices. ReCaptcha sends user data to Google and adds friction. The rules-side App Check check rejected every real caller and passed only in the emulator.

Rejected: magic links · ReCaptcha (never reintroduce) · App Check in security rules and the emulator-only app_check_bypass claim · scope checks only in callables.