Email-only auth. No password v1. Magic-link in your inbox.
In the prototype, this is the PersonaProvider switcher. It picks the role + seeds the right mock data.
Photos stay private to the college's batches. Face-vectors are hashed. Alumni can request takedown of any photo or face — one click, no review.