Fix gallery HTML structure bug and replace email auth with OTP flow

Gallery: remove <a> from share allowlist. Gallery cards wrap content in
<a class="gal-link">; allowing <a> in sanitized answer HTML causes nested
anchors that the HTML5 adoption agency algorithm resolves by restructuring
the DOM, producing mismatched </div> tags that leave gallery-grid open and
pull sibling elements into the grid as spurious grid columns.

Account: replace email+password sign-up/sign-in with magic-link OTP.
supabase.auth.signInWithOtp handles both new and existing users in one
flow. Existing onAuthStateChange listener (dadeb8ddb9a8.js) retained for
post-redirect dashboard display. sendMagicLink added to extract-js
RESERVED_GLOBALS so the obfuscator does not mangle the onclick reference.

src/gallery.el

@@ -7,7 +7,12 @@
 // main.el's binding would forward-reference at the C level. The DB column
 // is already sanitized at write time; this is belt-and-braces in case a
 // row was inserted out-of-band.
-let gallery_share_allowlist: String = "{\"p\":[],\"br\":[],\"strong\":[],\"em\":[],\"u\":[],\"s\":[],\"code\":[],\"pre\":[],\"ul\":[],\"ol\":[],\"li\":[],\"h1\":[],\"h2\":[],\"h3\":[],\"h4\":[],\"blockquote\":[],\"a\":[\"href\",\"title\"]}"
+// NOTE: <a> is intentionally excluded. Gallery cards wrap their content in
+// <a class="gal-link"> — allowing <a> in sanitized answer HTML causes nested
+// anchors, which the HTML5 parser resolves via the adoption agency algorithm,
+// producing mismatched </div> tags that break gallery-grid's closing tag and
+// pull sibling elements into the grid as spurious grid items.
+let gallery_share_allowlist: String = "{\"p\":[],\"br\":[],\"strong\":[],\"em\":[],\"u\":[],\"s\":[],\"code\":[],\"pre\":[],\"ul\":[],\"ol\":[],\"li\":[],\"h1\":[],\"h2\":[],\"h3\":[],\"h4\":[],\"blockquote\":[]}"
 
 fn gallery_page(cards_json: String, supabase_url: String, supabase_anon_key: String) -> String {
     let i: Int = 0