[bitifirefly]

Changes

• Reuse the existing server-side AUTH_PHONE_OTP_ENABLED flag to hide phone login on login/registration pages and redirect direct visits when disabled.
• Keep the existing enabled default and backend phone-plugin control; no new public build flag, schema migration or dependency change.
• Move the existing client page UI behind dynamic server wrappers so the runtime flag stays server-side and requires only a Web service restart after upgrading.
• Prepare v0.3.3 and document configuration, upgrade boundaries and the development-tooling cleanup since v0.3.2.

Validation

• Dev isolated automatic validation passed: 182 suites, 1,504 tests, root/API/shared types, scoped lint/format, guards, locale/content checks and shared/API/Web production build.
• Normal commit and pre-push hooks passed, as did the explicit outgoing publication scan.
• All six develop CI jobs passed, including real Docker build/startup smoke: https://github.com/iflabx/agentifui/actions/runs/43387066487
• Fixed-candidate Stage production build/deploy and HTTPS smoke passed. Browser/API acceptance passed 19 checks: desktop/mobile login and registration, hidden links, client navigation, direct-route redirect, disabled phone endpoints, retained email/GitHub entrypoints, assets and anonymous boundaries.
• Human acceptance: the release owner confirmed that phone-login entries are no longer displayed. Fresh manual login/logout, real OAuth, SSO and chat were not claimed in this batch; unchanged behavior retains its applicable earlier functional baseline, supplemented by the scoped automatic checks.

Release Boundary

• Intended annotated tag and GitHub Release: v0.3.3, matching package.json and CHANGELOG.md.
• No production deployment, database migration, credential publication or container recreation.
• Merge using a merge commit only after required PR checks and applicable Stage acceptance.