Dev mode — any email works; no password or MFA check.
Real SSO + TOTP MFA lands in Phase 2 once the identity service is wired to Postgres.