Improve local auth env handling and fallbacks

Allow local env files to reliably override authentication feature flags (SMS/WeChat) by whitelisting keys in scripts/dev-utils.mjs and adding a unit test. Add SMS checks to scripts/check-api-server-env.mjs. Make server config.parse_bool tolerant of shell-wrapped quoted values (e.g. '"true"') and add tests so SMS_AUTH_ENABLED is parsed correctly when shells supply quotes. Update docs to clarify SMS env behaviour, restart requirements, and add guidance + a CSS fallback for old mobile browsers (QQ/X5) so public cover images render even when aspect-ratio is unsupported. Also include related frontend test and component adjustments and add puzzle onboarding handlers/endpoints in server-rs/crates/api-server/src/puzzle.rs.

src/components/auth/LoginScreen.tsx

@@ -80,8 +80,8 @@ export function LoginScreen({
   const [legalConsentChecked, setLegalConsentChecked] = useState(false);
   const [activeLegalDocumentId, setActiveLegalDocumentId] =
     useState<LegalDocumentId | null>(null);
-  const passwordLoginEnabled = availableLoginMethods.includes('password');
-  const phoneLoginEnabled = availableLoginMethods.includes('phone');
+  const passwordLoginEnabled = true;
+  const phoneLoginEnabled = true;
   const wechatLoginEnabled = availableLoginMethods.includes('wechat');
   const [activeLoginTab, setActiveLoginTab] = useState<LoginTab>('phone');