Auth & Security
- OTP + Magic Link flows with no passwords, configurable per project via AUTH_METHOD.
- Mail delivery is built in via PHPMailer: use SMTP for real sends, or MAIL_MAILER=log for zero-config local development (codes and magic links in storage/logs/mail.log).
- CSRF protection, rate limiting, and dedicated 404/500 error pages ship out of the box.