docs: OTP within secure enclaves — new security page + updated activity types

[turnkeyintern]

Summary

Adds documentation for the new enclave-based OTP architecture released in SDK v2026.2.8.

What changed

New file: security/otp-enclave.mdx
A dedicated security page covering:

• Overview of the two OTP use cases (contact verification vs. login) and which enclave flow each uses
• The key invariant: coordinator never sees plaintext OTP in INIT_OTP_V3
• Full sequence flow for INIT_OTP_V3 (enclave-generated), INIT_OTP_AUTH_V3 (coordinator-generated, legacy), and VERIFY_OTP_V2
• Token consumption (OTP_LOGIN_V2, signup)
• Security controls: bundle signature verification, HPKE encryption of OTP attempt, constant-time comparison, brute-force protection, inflight limits, TTL
• Client-side SDK changes table (publicKey required, verifyEnclaveSignature, HPKE replaces quorumKeyEncrypt, etc.)
• Error codes

Updated: authentication/email.mdx

• New callout card at the top of Core Mechanism section linking to the security page, with a summary of the v2026.2.8 client-side security improvements
• Activity type references updated: INIT_OTP → INIT_OTP_V3, VERIFY_OTP → VERIFY_OTP_V2, OTP_LOGIN → OTP_LOGIN_V2
• Breaking Change warning expanded to include VERIFY_OTP_V2 and OTP_LOGIN_V2 version progressions
• Authorization section updated to show both enclave (V3) and legacy auth (V3) paths

Updated: authentication/sms.mdx

• How It Works section updated to use V3/V2 activity types with brief enclave note
• Sandbox section references updated
• Note linking to the security page added

Updated: docs.json

• security/otp-enclave added to the Security tab navigation (after enclave-secure-channels)