- Changed OTP from 6 digits to 4 digits
- Code 0000 always works in demo mode (no external SMS needed)
- Relaxed rate limit from 3 to 5 attempts, timeout 300s
- Validation accepts 4-6 digit codes for flexibility
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>