BaseCamp uses passkey (FIDO2 / WebAuthn) for phishing-resistant authentication. No passwords. SMS deprecated per NIST 800-63B-rev4. This MVP build skips the real WebAuthn flow.