OPT and Improved Installation Wizzard

1. Summary of changes
Password auth → email OTP, everywhere it existed for the tenant/business app: sign-in, customer self-registration (/register), staff-invitation acceptance, and the installer's administrator step. Flow is always: email → 6-digit code emailed → code entered → session created, via one shared service (otp.service.ts) reused by every entry point.
NextChair Manager's own auth was not touched — this only affects tenant-side (business admin/staff/customer) authentication, per the spec's explicit instruction.
Installer improvements: Step 2 (Administrator) now asks only Name + Email + optional Phone, verified inline via the same OTP widget (no redirect). Step 3 (Business Details) pre-fills Business Name from the Manager-provisioned BUSINESS_NAME, shows the booking URL (NEXT_PUBLIC_APP_URL) as a read-only info box instead of asking for it, and has a distinctly-labeled "Business Website (optional)" field with copy clarifying it's not the booking URL.
Installation cannot complete with an unverified admin email — enforced server-side (finalizeOtp runs inside the same DB transaction as user/business creation), not just trusted from client state. A mid-wizard refresh still can't create duplicate admins or partial records — that property was preserved by design, not incidentally.
2. Prisma/database changes
New EmailOtp model (email as PK — one row per address, so a new request naturally invalidates the previous code): codeHash, purpose, expiresAt, attempts, verifiedAt, consumedAt, timestamps. Only a bcrypt hash of the code is ever stored.
User.passwordHash — unchanged schema (already nullable), just annotated as deprecated. No destructive migration; historical rows are untouched.
Migration: prisma/migrations/20260905190022_email_otp_authentication — adds EmailOtp only. Generated and applied against throwaway containers only; the real next-chair-mysql production database was never touched (confirmed not even running on this host during this session).
3. New environment variables
None required for production. One new variable, E2E_TEST_MODE, exists purely for the Playwright suite (set only in playwright.config.ts's webServer.env) — it unlocks a /api/test/otp-code debug endpoint and bypasses OTP rate limiting so the same seeded users can sign in dozens of times across one test run. It must never be set on a real deployment; nothing in the app sets it anywhere else.

4. Email delivery configuration
Nothing new to configure. OTP emails reuse the existing EmailProvider abstraction and EMAIL_PROVIDER env var exactly as configured today — console in dev (prints to server logs), brevo in production via the same SMTP credentials already documented. The OTP email is a new template (otp-email.ts) sent directly (bypassing the async notification/cron pipeline, since a 10-minute-expiry code can't wait for a delivery retry loop).

5. Migration considerations for existing users/installations
Existing users lose password sign-in — the only way to authenticate now is email OTP. There is no in-app fallback; this is an intentional, sharp cutover. If existing customers/staff/admins need advance notice, that's a business/communications decision outside this change.
No account data is deleted or migrated — passwordHash rows are simply never read for auth anymore.
prisma/seed.ts / scripts/ensure-super-admin.ts still set a passwordHash for seeded dev users — harmless and vestigial now, not cleaned up (flagging it rather than touching seed data silently).
Installations already completed are unaffected; only new installer runs go through the OTP admin-verification step.
6. Files changed
New:

src/lib/auth/otp.service.ts — the core requestOtp/verifyOtp/finalizeOtp service
src/lib/auth/__tests__/otp.service.integration.test.ts
src/services/notifications/templates/otp-email.ts
src/features/auth/components/otp-code-step.tsx — shared code-entry UI
src/features/auth/actions/request-sign-in-otp.ts
src/app/api/test/otp-code/route.ts — e2e-only, gated on E2E_TEST_MODE
prisma/migrations/20260905190022_email_otp_authentication/
Modified — auth core: prisma/schema.prisma, src/auth.ts, src/features/auth/schemas.ts

Modified — sign-in/register/invitations: sign-in-form.tsx, register.ts, register-form.tsx, accept-invitation.ts, accept-invitation-form.tsx, staff-invitation.service.ts

Modified — installer: installer.service.ts, schema.ts, install.ts, install-wizard.tsx, install/page.tsx, installer.service.integration.test.ts

Modified — email / e2e infra: console-email-provider.ts, playwright.config.ts, e2e/helpers.ts, and the four e2e/*.spec.ts files (dropped the now-unused password argument from every signIn() call).

7. Verification performed
npx tsc --noEmit, npm run lint, npm test (276 unit) — all clean.
npm run test:integration (207 tests, throwaway DB) — includes 11 new OTP-service tests and a rewritten installer suite; a genuine race condition in requestOtp (concurrent requests for a brand-new email double-hitting the upsert's create branch) was caught and fixed here.
Full npm run test:e2e against a fresh throwaway database: 36/37 passed. The one failure (owner-journeys "opening hours conflict" test) is a pre-existing, auth-unrelated ordering flake — appointment-count ambiguity from earlier tests' bookings — not something this change touches or introduced.
Live manual verification in-browser: existing seeded customer sign-in via OTP; new customer registration via OTP (session created, landed on Home); installer wizard end-to-end through Step 3, confirming email-verification gating, Business Name pre-population from BUSINESS_NAME, and the read-only Booking URL / distinct Business Website fields.
All throwaway Docker containers/DBs used for this work have been removed; the real production database was never touched.

src/features/installation/installer.service.ts

@@ -1,6 +1,6 @@
-import bcrypt from "bcryptjs";
 import type { PrismaClient, Prisma } from "@/generated/prisma/client";
 import { InstallationStatus, RewardType } from "@/generated/prisma/enums";
+import { finalizeOtp } from "@/lib/auth/otp.service";
 import { INSTALLATION_SINGLETON_ID } from "@/lib/installation/installation-state";
 import { OWNER_PERMISSIONS, BARBER_PERMISSIONS } from "@/lib/roles/default-permissions";
 import { secretsMatch } from "@/lib/security/secrets-match";
@@ -16,6 +16,7 @@ export type InstallErrorCode =
   | "ALREADY_INSTALLED"
   | "VALIDATION_FAILED"
   | "EMAIL_ALREADY_IN_USE"
+  | "EMAIL_NOT_VERIFIED"
   | "INSTALL_FAILED";
 
 export interface InstallSuccess {
@@ -32,6 +33,16 @@ export interface InstallFailure {
 
 export type InstallResult = InstallSuccess | InstallFailure;
 
+/** Thrown inside the transaction to carry a specific InstallErrorCode out through the generic try/catch below — see installApplication's own use. */
+class InstallStepError extends Error {
+  constructor(
+    readonly code: InstallErrorCode,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
 function slugify(name: string): string {
   const base = name
     .toLowerCase()
@@ -149,6 +160,22 @@ export async function installApplication(
 
       const { administrator, business: businessInput, location, hours, bookingRules, branding, starterServices } =
         params.input;
+      const administratorEmail = administrator.email.toLowerCase();
+
+      // The administrator's email must have been verified via OTP in the
+      // wizard's own Administrator step (see install-wizard.tsx and
+      // src/lib/auth/otp.service.ts's verifiedAt/consumedAt design) —
+      // checked and consumed here, inside this same transaction, so it
+      // rolls back together with everything else if a later step fails
+      // (letting an immediate retry reuse the same verification) and so
+      // installation genuinely cannot complete with an unverified email,
+      // not just "the client claimed it was verified".
+      if (!(await finalizeOtp(tx, administratorEmail))) {
+        throw new InstallStepError(
+          "EMAIL_NOT_VERIFIED",
+          "This email hasn't been verified — please verify it again before finishing setup.",
+        );
+      }
 
       const business = await tx.business.create({
         data: {
@@ -216,13 +243,13 @@ export async function installApplication(
         }),
       ]);
 
-      const passwordHash = await bcrypt.hash(administrator.password, 12);
       const user = await tx.user.create({
         data: {
-          email: administrator.email.toLowerCase(),
+          email: administratorEmail,
           name: `${administrator.firstName.trim()} ${administrator.lastName.trim()}`,
           phone: administrator.phone?.trim() || null,
-          passwordHash,
+          // Email OTP is the only auth method now — see finalizeOtp above,
+          // which is what actually proved this email, not a password.
           emailVerified: new Date(),
           staffProfile: {
             create: {
@@ -299,11 +326,15 @@ export async function installApplication(
 
     return { success: true, userId: result.userId, businessId: result.businessId };
   } catch (error) {
-    // A concurrent installer won the create() race — see the header
-    // comment above. Anything else is an unexpected failure; either way,
-    // the transaction rolled back and left no partial data (see
+    // A concurrent installer won the create() race, or the administrator's
+    // email wasn't verified — see the header comment above and
+    // InstallStepError. Anything else is an unexpected failure; either
+    // way, the transaction rolled back and left no partial data (see
     // ApplicationInstallation's own header for why that's true even for
     // the lock row itself).
+    if (error instanceof InstallStepError) {
+      return { success: false, code: error.code, message: error.message };
+    }
     const isDuplicateSingleton =
       typeof error === "object" && error !== null && "code" in error && (error as { code?: string }).code === "P2002";
     if (isDuplicateSingleton) {