Mock interview: phone OTP sign-in and sessions at Paisly

A full 45-minute model interview: Siddharth splits sign-in into its four paths, finds that the Diwali sale needs both SMS providers live, stores the OTP as an HMAC with capped guesses, uses signed tokens with a pushed deny list for lost phones, fails over on delivery receipts, fixes a replica-lag bug and a hot celebrity number, and pushes back on 7-day sessions with numbers.