feat(identity): test-only fixed OTP channel and rectification candidate cards

- IDENTITY_TEST_OTP env: when set to a 6-digit code, no real email is
  delivered; login page surfaces the fixed code so testers can register
  and sign in without a mailbox. Opt-in, never set in production.
- email-otp-login: test-channel notice with the pinned code.
- Rectification candidate list restyled with the project design system
  (warm canvas, action color, display serif, soft shadow, hover lift).
- Regression tests for config parsing, pinned OTP generation, login UI
  notice, and candidate card styles.

frontend/src/modules/identity/auth.ts

@@ -8,6 +8,7 @@ import {
   type SelfHostedIdentityConfig,
 } from "./config.ts";
 import type { EmailOtpSender } from "./contracts.ts";
+import { FakeEmailOtpSender } from "./email/fake-email-otp-sender.ts";
 import { ResendEmailOtpSender } from "./email/resend-email-otp-sender.ts";
 
 interface AdminRoleRow {
@@ -88,10 +89,12 @@ export function createIdentityAuthServices(
   const pool = dependencies.pool ?? createIdentityPool(config.databaseUrl);
   const emailSender =
     dependencies.emailSender ??
-    new ResendEmailOtpSender({
-      apiKey: config.resendApiKey,
-      from: config.resendFrom,
-    });
+    (config.testOtp
+      ? new FakeEmailOtpSender()
+      : new ResendEmailOtpSender({
+          apiKey: config.resendApiKey,
+          from: config.resendFrom,
+        }));
   return {
     pool,
     user: betterAuth(