Mock auth — no email sent, no password checked. Phone/VAT are required at registration in the real flow.