In production we send a one-time sign-in link. In local demo mode, any email works.
Demo mode: any email works and no email is sent. Add Supabase keys for real magic links.