docs: design spec + backend ask for email/phone OTP login (item 4)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

BACKEND-API-REFERENCE.md

@@ -115,6 +115,33 @@ Storage: `localStorage['ed25519AdminToken']` (access), `localStorage['ed25519Adm
 
 **Open decision (business, not technical — ask a human):** whether Mechanism A is retired outright in favor of Mechanism B at cutover, or both run in parallel gated by role/tenant config.
 
+### 2c. Email/phone OTP login — customer (NOT IMPLEMENTED, proposed)
+
+**Gap:** customer storefront login/checkout requires Telegram (Mechanism A) — shoppers without Telegram have no way to identify themselves. Raised as a real usability problem, not a hypothetical.
+
+**Ask:** a third, independent auth mechanism (coexists with 2a/2b, replaces neither):
+
+```
+POST /auth/otp/request
+Body: { "identifier": "user@example.com" }   // or E.164 phone, e.g. "+79991234567"
+Response: { "requestId": "...", "expiresAt": "2026-08-15T10:15:00Z" }
+```
+
+```
+POST /auth/otp/verify
+Body: { "requestId": "...", "code": "482913" }
+Response (on success): {
+  "sessionId": "...", "userId": 8823771, "username": null,
+  "displayName": "user@example.com", "active": true, "expires": "2026-08-15T11:15:00Z"
+}
+```
+
+The success response must be shaped identically to the existing `AuthSession` (`sessionId, userId, username, displayName, active, expires`, §2a's client model) — this lets every existing downstream consumer (guards, session signals, cart/checkout) work unchanged regardless of which mechanism produced the session.
+
+Rate limiting/expiry, explicit so nothing is left to guesswork: 60s resend cooldown per identifier between `/request` calls; code expires 10 minutes after issuance; `requestId` is single-use (a `/verify` call consumes it on success or failure — a fresh `/request` is needed after either).
+
+See `docs/superpowers/specs/2026-08-15-email-phone-login-design.md` for the full design. No client code exists yet — nothing to build against a 404.
+
 ---
 
 ## 3. Bootstrap — the runtime config document