A privacy-first authentication template for Next.js that lets users sign in with email without storing email addresses in the database. The system uses HMAC-SHA256 to create stable pseudonymous user IDs, short-lived JWT magic links, replay protection, rate limiting, Cloudflare Turnstile, and signed session cookies.