Resend OTPDescription: same as request — hashes the phone, stores a new one-time code, sends it unless mock. Same rate limit window.Usage: customer didn't get the first SMS. Same phone + product_id as request.Details: body { phone, product_id }. Response { ok: true }. Too many requests → 429 rate_limited.Next:POST /auth/otp/verify.Auth: public (no Bearer).Errors:422 phone_required | product_id_required | invalid_phone | invalid_product · 429 rate_limited