Passport.js Email OTP with Rovela (2026): Custom Strategy + Session
Express + Passport custom email-OTP strategy: app mints crypto.randomInt + HMAC codes, Rovela POST /emails delivers, then req.login establishes the Passport session. Distinct from plain Express OTP without Passport.