auth: store-review test login + matchmaking no-hang/watchdog

- OtpService: a designated test phone (default 09120000000 / code 453115,
  overridable via Sms__TestPhone/Sms__TestCode) skips real SMS and always
  verifies — for Google Play / Bazaar / Myket reviewers. Give them these creds.
- Matchmaking UX: tapping a league now navigates to the matchmaking screen
  BEFORE awaiting the SignalR handshake, so the button can't freeze. Added a
  watchdog hint after 28s ("connection took too long, cancel & retry") so it
  never spins forever when the hub doesn't connect.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -67,6 +67,10 @@ services:
       Sms__Provider: ${SMS_PROVIDER:-kavenegar}
       Sms__ApiKey: ${SMS_API_KEY:-}
       Sms__Template: ${SMS_TEMPLATE:-hokmotp}
+      # Store-review test login (Google Play / Bazaar / Myket): this phone skips
+      # SMS and always accepts the static code. Give these to the review team.
+      Sms__TestPhone: ${SMS_TEST_PHONE:-09120000000}
+      Sms__TestCode: ${SMS_TEST_CODE:-453115}
       # Admin panel (marketing-site links editor) — shared-token auth.
       Admin__Token: ${ADMIN_TOKEN:-}
       # Where the admin-editable site-links JSON is persisted (mounted volume).