Fixed login — no more prompt(). Centered phone+password modal with gold leaf. Secure HMAC tokens, hosting-compatible headers.