Email + password, handled by Better Auth on @flam/api.