[auth] allow attendee onboarding and login without hca

requested for haven: attendees should be able to complete onboarding and sign in without needing hca.

all logins currently go through auth, per the email discussion, so investigate how to support an email-based alternative. email verification codes or magic links are both acceptable; the implementation approach is open.

acceptance criteria:

- attendees can verify their email, sign in, and complete onboarding without hca.
- returning attendees can use the same email-based login flow.
- document the chosen approach and any implications for the existing auth integration.

context: haven / attend email discussion, 10 september 2026.

Start by tracing the existing auth path used by all logins and the attendee onboarding flow, then compare how returning attendees enter the system. Choose either email verification codes or magic links, verify that both new and returning attendees can sign in and complete onboarding without HCA, and document the chosen approach and its implications for the existing auth integration.

Written by the indexing model from the issue text.