[auth] allow attendee onboarding and login without hca

[leowilkin]

requested for haven: attendees should be able to complete onboarding and sign in without needing hca.

all logins currently go through auth, per the email discussion, so investigate how to support an email-based alternative. email verification codes or magic links are both acceptable; the implementation approach is open.

acceptance criteria:

• attendees can verify their email, sign in, and complete onboarding without hca.
• returning attendees can use the same email-based login flow.
• document the chosen approach and any implications for the existing auth integration.

context: haven / attend email discussion, 10 september 2026.

[leowilkin]

We're not going to support this - for the specific case of satellite events, Slack accounts are created via HCA, so not signing in with HCA is a bit of a nothing-burger, and complicates Attend's user account process.