auth: login with phone (+password if set) or Google

Goal

Implement login flow using phone number + optional password logic, and Google sign-in.

Requirements

• Support login by phone number.
• If user has password (passwordEnabled = true): require password validation.
• If user has no password (passwordEnabled = false): login allowed when phone exists in DB.
• Support Google sign-in login.

Firebase Scope

• Authenticate via Firebase Auth.
• Read user profile from Firestore (users collection).
• Keep login behavior consistent with sign-up data model.

Functional Behavior

• Phone login flow:
  • Lookup user by phone number.
  • Branch on passwordEnabled:
    • true -> verify provided password against hash.
    • false -> no password prompt; allow login if user exists.
• Google login flow:
  • Sign in with Google provider.
  • Link/fetch corresponding user profile.
• Return clear errors for:
  • user not found
  • wrong password
  • provider mismatch or missing profile record

Acceptance Criteria

• Phone users with password cannot login without password.
• Phone users without password can login using phone existence check.
• Google users can login via Google successfully.
• Session state and user profile are loaded after successful login.
• Error handling is clear and testable.

Notes

• Password storage/verification must remain hashed only.
• Add tests for both password-enabled and password-disabled login paths.

Start at the Firebase Auth login entry point and inspect how profiles are read from the Firestore users collection and how sign-up stores passwordEnabled data. Trace the phone and Google flows, including session and profile loading, then add tests for password-enabled and password-disabled phone users plus Google login and the specified errors. Done means all acceptance criteria pass without exposing unhashed passwords.