fix(auth): advance to OTP code step in production + clear profile on logout

- AuthScreen gated the code-entry step on devCode != null, so with real SMS
  (no devCode) it got stuck after "send". Gate on a `sent` flag instead; add
  sending state, send-failure message, "code sent" hint, change-number, and
  raise the code input cap to 6 (codes are 5 digits).
- signOut now resets the store to a fresh guest profile, and the SignalR
  service clears its cachedProfile — so the previous user's name/avatar no
  longer linger after logout.
- i18n: auth.sending / sendFailed / codeSent / invalidPhone / changeNumber.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/online/signalr-service.ts

@@ -231,6 +231,7 @@ export class SignalrService implements OnlineService {
   async signOut() {
     this.session = null;
     this.token = null;
+    this.cachedProfile = null; // drop the signed-in profile so it can't leak post-logout
     if (typeof window !== "undefined") localStorage.removeItem(LS_SESSION);
     await this.conn?.stop();
     this.conn = null;