fix(admin): don't prefill a fake phone on the admin login in production

The admin login OTP tab hard-coded phone "09120000001" as the initial value.
In production that placeholder belongs to no SystemAdmin, so hitting "send code"
returns NOT_FOUND → 404 (which WCDN then repaints as an HTML error page) — it
looked like the login endpoint was broken. Keep the convenience prefill in
development only; ship an empty field in production so the admin types their
real number (e.g. the registered admin phone).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/admin/src/app/[locale]/admin/login/page.tsx

@@ -23,8 +23,11 @@ export default function AdminLoginPage() {
 
   const [tab, setTab] = useState<LoginTab>("otp");
 
-  // OTP state
-  const [phone, setPhone] = useState("09120000001");
+  // OTP state — never prefill a real-looking phone in production; a placeholder
+  // number sends the OTP to a non-existent admin and returns a confusing 404.
+  const [phone, setPhone] = useState(
+    process.env.NODE_ENV === "development" ? "09120000001" : ""
+  );
   const [code, setCode] = useState("");
   const [otpStep, setOtpStep] = useState<"phone" | "otp">("phone");