PIN sign-in, because the code could never arrive

── What was actually broken ──

The SMS gateway was switched off, and `POST /auth/otp/request` does not fail
when that happens: it still answers `sent: true`, still issues a valid 4-digit
code, and writes it to the **server log**. So the phone path walked customers
to a code screen for a code that could not arrive, and every digit they
eventually typed was wrong. The failure read to them as "I entered it wrong".

Phone sign-in is now a PIN, which needs no gateway.

── Email still sends codes, so email is untouched ──

Email OTP goes over SMTP and works. Deleting a working way in to tidy up a
broken one is a net loss for anyone with an email on their account, so "Use
email instead" and the code screen stay exactly as they were.
`login_otp_guard_test` moves to that path — the `sent: false` guard still
matters there, and that is now the only place it can fire.

── One screen, three entrances ──

`POST /auth/login` says which of them a number is before anything is asked, so
the app never guesses. Guessing is not cosmetic: offer "create a PIN" to a
returning customer and the server answers `pin_already_set` on a screen that
cannot succeed; offer "enter your PIN" to somebody who has never set one and
every attempt is wrong.

The separate sign-up screen is deleted rather than hidden. It asked for a name
and then sent an SMS code — a second entrance asking the same questions and
posting a letter that never lands. A new number now gives its name and PIN on
the same screen.

── A second sign-in path found a latent bug ──

`AppState.signIn` only started `refreshOrders`, and the OTP screen called
`detectPickupLocation` itself afterwards to make up the difference. That held
exactly as long as there was one sign-in screen. PIN sign-in did not know about
the extra call, so Home opened with no pickup and no serviceable cities.

The work belongs to signing in, not to whichever screen happened to be last, so
it moved into `signIn` and the OTP screen's copy is gone.

── What the screen deliberately does not do ──

It does not greet by name. `POST /auth/login` returns the account holder's
name, which tells anybody who types a number who owns it; the field is read but
never displayed, so it disappears quietly when the backend drops it.

It does not say whether the number or the PIN was wrong — the server answers
identically for both on purpose, and narrowing it here would turn sign-in into
a way of testing whether a number has an account.

"Forgot your PIN?" renders only when a support contact is configured. There is
no reset endpoint, so it can only point at a human — and telling somebody
locked out that help exists without saying where is worse than silence.

── The handover note does not reach the Miler ──

The app said "we pass this to your Miler as a note". It does not: `remarks`
reaches the admin console and stops, because the rider app reads a `notes`
field per stop that the backend never sends. A customer could hand their parcel
to a neighbour believing the Miler had been told. Both screens now say it is
recorded on the booking, and that the Miler still calls the account's number.

── Also ──

DmTextField gains `obscure`, and PinScreen carries a back button — without one
the only correction for a mistyped digit was killing the app.

lib/data/models.dart

@@ -258,6 +258,74 @@ double? coordinate(Map<String, dynamic> json, String key) {
 /// The server owns both numbers, and the OTP screen is built from them rather
 /// than from constants: a backend that moves to a six-digit code, or lengthens
 /// the resend window, must not need an app release to be usable.
+/// What `POST /customer/auth/login` answers about a phone number.
+///
+/// ── Why the app asks before it shows a field ──
+///
+/// PIN sign-in has three entrances and they look identical to a customer: an
+/// unknown number, a known number with no PIN yet, and a known number with
+/// one. Guessing wrong means asking somebody to "enter your PIN" when they
+/// have never set one, or asking a returning customer to invent a new one over
+/// the top of theirs (which the server refuses with `pin_already_set`, leaving
+/// them stuck on a screen that cannot succeed).
+///
+/// One call up front removes the guess. The screen that follows is the right
+/// one every time.
+class PhoneCheck {
+  const PhoneCheck({
+    required this.phone,
+    required this.registered,
+    required this.pinSet,
+    this.name,
+  });
+
+  /// The number as the server normalised it — E.164. Sent back on the next
+  /// call rather than re-normalised here, so both requests agree.
+  final String phone;
+
+  final bool registered;
+  final bool pinSet;
+
+  /// The account holder's first name, when there is an account.
+  ///
+  /// The server returns it and the backend has been asked to stop, because it
+  /// discloses who owns a number to anybody who types it. The app therefore
+  /// **does not display it** — it is read only so that it disappears quietly
+  /// when the backend drops the field, rather than becoming a missing greeting
+  /// somebody has to go and diagnose.
+  final String? name;
+
+  /// Which screen comes next.
+  PhoneStep get step => !registered
+      ? PhoneStep.createAccount
+      : (pinSet ? PhoneStep.enterPin : PhoneStep.createPin);
+
+  factory PhoneCheck.fromJson(Map<String, dynamic> json, String fallback) =>
+      PhoneCheck(
+        phone: (json['phone'] as String?)?.trim().isNotEmpty == true
+            ? (json['phone'] as String).trim()
+            : fallback,
+        // snake_case here and nowhere else on the customer surface — the PIN
+        // routes were added separately and spell it `pin_set`. Both are read
+        // so a later tidy-up on the server does not break sign-in.
+        registered: (json['registered'] ?? json['isRegistered']) == true,
+        pinSet: (json['pin_set'] ?? json['pinSet']) == true,
+        name: (json['name'] as String?)?.trim(),
+      );
+}
+
+/// The screen a phone number leads to.
+enum PhoneStep {
+  /// No account: ask for a name and a new PIN.
+  createAccount,
+
+  /// Account exists, no PIN: ask for a new PIN only.
+  createPin,
+
+  /// Account with a PIN: ask for it.
+  enterPin,
+}
+
 class OtpChallenge {
   const OtpChallenge({
     this.codeLength = 4,