Patient/member two-step verification.

Patient/member login first. A verification code will be emailed after the password is accepted.

Login diagnostics: /portal sends patients/members here first. Code page opens only after password is accepted. Reset password sends a secure Firebase reset email. Passwords are never shown or saved in Firestore.