Passwordless sign-in: 6-digit email codes, feature-flagged on SendGrid key

/api/auth/email/start issues a 15-min code (60s resend guard, 6 tries);
verify creates the account passwordless (sponsor cookie first-touch) and
mints the session. UI swaps the password cards for the code flow when
config.emailAuth is on; dev mode returns the code inline. Password flow
remains until the key lands in the volume (data/sendgrid.key) or
SENDGRID_KEY env.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/my.html

@@ -15,7 +15,17 @@
   </section>
 
   <div id="authArea">
-    <div class="grid c2">
+    <div class="card" id="magicCard" hidden>
+      <h3>Sign in or join free</h3>
+      <p class="muted small">Type your email and we send a 6-digit code. No password to invent,
+        no password to forget. New emails get a free account automatically.</p>
+      <p><input id="mcEmail" type="email" placeholder="Email" autocomplete="email" style="width:100%;max-width:420px"></p>
+      <p id="mcCodeRow" hidden><input id="mcCode" inputmode="numeric" placeholder="6-digit code" style="width:100%;max-width:420px"></p>
+      <button class="btn" id="mcSendBtn">Email me a code</button>
+      <button class="btn" id="mcVerifyBtn" hidden>Sign in</button>
+      <button class="btn sec small" id="mcResend" hidden>Send a fresh code</button>
+    </div>
+    <div class="grid c2" id="passCards">
       <div class="card">
         <h3>Create your free account</h3>
         <p class="muted small">Takes ten seconds. No wallet needed to join.</p>