feat(signup): present the Fayda proof after signup and skip the second OTP

The verify step now returns an encrypted verificationToken alongside the
readable identity. After the existing signup succeeds, the page posts it to
POST /profiles/me/fayda, which marks the phone verified when it is the one
Fayda vouched for and fills the still-empty profile fields. Best-effort: the
account already works if the call fails, and the token can be presented again.

When the server confirms the phone, the page goes straight to the portal
instead of /otp-verify — Fayda already verified that exact number with its own
OTP, and asking for a second one on the same number is theatre. An applicant
who edited the prefilled number still gets the normal OTP step.

libs/auth/src/lib/pages/SignupPage.tsx

@@ -76,6 +76,7 @@ export function SignupPage() {
     transactionToken: string;
     expiresIn: number;
   }>();
+  const [linkTrigger] = useApiMutation<{ phoneNumberVerified?: boolean }>();
 
   const verified = (field: string) => fayda?.verifiedFields.includes(field) ?? false;
   const conflicted = (field: string) => fayda?.conflicts.includes(field) ?? false;
@@ -89,8 +90,10 @@ export function SignupPage() {
   const faydaMark = (field: string): { description?: React.ReactNode } => {
     if (conflicted(field)) {
       return {
+        // component="span" on these badges: the description slot renders
+        // inside a <p>, where Badge's default <div> is invalid HTML.
         description: (
-          <Badge size="xs" variant="light" color="orange">
+          <Badge component="span" size="xs" variant="light" color="orange">
             {t('fayda.fieldConflict', 'Already used by another account')}
           </Badge>
         ),
@@ -100,6 +103,7 @@ export function SignupPage() {
       return {
         description: (
           <Badge
+            component="span"
             size="xs"
             variant="light"
             color="teal"
@@ -234,9 +238,28 @@ export function SignupPage() {
       const me = await meTrigger({ url: '/auth/me', method: 'GET' }).unwrap();
       dispatch(setUser(me));
 
+      // Records the Fayda-verified identity on the new account: marks the
+      // phone verified when it is the one Fayda vouched for, and fills the
+      // still-empty profile fields. Best-effort — the account already works,
+      // and the token can be presented again on a retry.
+      let faydaPhoneVerified = false;
+      if (fayda?.verificationToken) {
+        try {
+          const applied = await linkTrigger({
+            url: '/profiles/me/fayda',
+            method: 'POST',
+            body: { verificationToken: fayda.verificationToken },
+          }).unwrap();
+          faydaPhoneVerified = Boolean(applied?.phoneNumberVerified);
+        } catch {
+          /* deliberately ignored — signup already succeeded */
+        }
+      }
       faydaSession.clearResult();
 
-      if (data.isPhoneNumberVerified) {
+      // Fayda already verified this exact number via its own OTP; asking for
+      // a second OTP on the same number is theatre.
+      if (data.isPhoneNumberVerified || faydaPhoneVerified) {
         navigate(loginRedirectPath);
       } else {
         navigate('/otp-verify', {

libs/auth/src/lib/utils/fayda-session.ts

@@ -24,6 +24,9 @@ export interface FaydaPrefill {
   /** Shown for context only — the signup form has no field for these. */
   gender?: string;
   address?: string;
+  birthdate?: string;
+  nationality?: string;
+  faydaNumber?: string;
 }
 
 /** Shape of `POST /auth/register-with-fayda` with `action: "verify"`. */
@@ -34,6 +37,11 @@ export interface FaydaResult {
   verifiedFields: string[];
   /** Prefilled fields already taken by another account. */
   conflicts: string[];
+  /**
+   * Encrypted proof of the verification, presented to POST /profiles/me/fayda
+   * after signup so the account and profile record what Fayda vouched for.
+   */
+  verificationToken: string;
 }
 
 // Private browsing and locked-down browsers can throw on access, and a failure