fix(auth): advance to OTP code step in production + clear profile on logout

- AuthScreen gated the code-entry step on devCode != null, so with real SMS
  (no devCode) it got stuck after "send". Gate on a `sent` flag instead; add
  sending state, send-failure message, "code sent" hint, change-number, and
  raise the code input cap to 6 (codes are 5 digits).
- signOut now resets the store to a fresh guest profile, and the SignalR
  service clears its cachedProfile — so the previous user's name/avatar no
  longer linger after logout.
- i18n: auth.sending / sendFailed / codeSent / invalidPhone / changeNumber.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/i18n.tsx

@@ -282,6 +282,11 @@ const fa: Dict = {
   "auth.toggleSignup": "حساب ندارید؟ ثبت‌نام کنید",
   "auth.toggleSignin": "حساب دارید؟ وارد شوید",
   "auth.invalidCode": "کد نادرست است",
+  "auth.invalidPhone": "شماره موبایل را درست وارد کنید",
+  "auth.sending": "در حال ارسال…",
+  "auth.sendFailed": "ارسال پیامک ناموفق بود، دوباره تلاش کنید",
+  "auth.codeSent": "کد به شماره شما پیامک شد",
+  "auth.changeNumber": "تغییر شماره",
   "auth.otherSoon": "سایر روش‌های ورود به‌زودی فعال می‌شوند",
 
   "reward.title": "پاداش بازی",
@@ -646,6 +651,11 @@ const en: Dict = {
   "auth.toggleSignup": "No account? Sign up",
   "auth.toggleSignin": "Have an account? Sign in",
   "auth.invalidCode": "Invalid code",
+  "auth.invalidPhone": "Enter a valid mobile number",
+  "auth.sending": "Sending…",
+  "auth.sendFailed": "Couldn't send the SMS, try again",
+  "auth.codeSent": "Code sent to your number",
+  "auth.changeNumber": "Change number",
   "auth.otherSoon": "Other sign-in methods coming soon",
 
   "reward.title": "Match rewards",

src/lib/online/signalr-service.ts

@@ -231,6 +231,7 @@ export class SignalrService implements OnlineService {
   async signOut() {
     this.session = null;
     this.token = null;
+    this.cachedProfile = null; // drop the signed-in profile so it can't leak post-logout
     if (typeof window !== "undefined") localStorage.removeItem(LS_SESSION);
     await this.conn?.stop();
     this.conn = null;

src/lib/session-store.ts

@@ -88,7 +88,9 @@ export const useSessionStore = create<SessionStore>((set, get) => ({
 
   signOut: async () => {
     await getService().signOut();
-    set({ session: null, isAuthed: false });
+    // Reset to a fresh guest profile so the old name/avatar don't linger.
+    const profile = await getService().getProfile();
+    set({ session: null, isAuthed: false, profile });
   },
 
   updateProfile: async (patch) => {