Use email and password for this MVP. Google and phone login can plug into the same session model later.