Security:5 Fix HMAC handshake, generate API keys in Google Login, and relax JWT issuer

app/Http/Controllers/OtpController.php

@@ -108,8 +108,10 @@ class OtpController extends Controller
         // TODO: Send SMS/WhatsApp via external provider
 
         // Check if passenger exists to allow immediate login (V1 style)
+        // Note: Phone is stored ENCRYPTED in passengers table in V1
+        $encPhone = $this->encryption->encrypt($phone);
         $passenger = DB::connection('primary')->table('passengers')
-            ->where('phone', $phone)
+            ->where('phone', $encPhone)
             ->first();
 
         return $this->success([