Demo experience — accounts, Google sign-in and email codes aren't live yet; this shows the real sign-in flow. In production these connect to a secure backend (encrypted passwords, real email codes, optional 2-factor authentication).