Magic link via Supabase Auth. Set DISABLE_AUTH=true for local development without Supabase.
DISABLE_AUTH=true