One-time magic-login link (no password required). Used for account-recovery flows where we need to give a paying member access without making them deal with a password reset.

The token is a JWT signed by JWT_SECRET with type='magic_login'. On success we issue a fresh standard auth JWT (same kind /auth/login returns) and set the dba_token cookie, then redirect to /. On failure we redirect to /login?error=... rather than returning a JSON 401, because the user is coming from a click in chat / Telegram and a redirect feels cleaner.