Prototype notice: Mobile number + OTP login here is a frontend-only demo — the OTP is generated and shown on-screen instead of being sent by SMS, and any number that doesn't match a squad member or an appointed admin number logs in as a read-only Guest. In production replace this with real endpoints (CONFIG.OTP_API_ENDPOINT / CONFIG.OTP_VERIFY_ENDPOINT) and server-side session verification — see AuthService in assets/core.js.