Passwordless Phone Login: SMS OTP Cooldown and Max Attempts

Treat passwordless phone login as a small SMS OTP state machine, not as two Express or Node.js...