Phase 2 shell — mock authentication. No Supabase connection, no real account, no email sent, no migration applied. The controls below move a local state machine so every screen can be reviewed.