Passwordless magic link. If AUTH_SECRET is set without an email provider, we show a one-time dev URL instead of sending mail.