10. Magic Link Login

A passwordless sign-in option. When enabled:

1. User enters email on login page and clicks "Email me a sign-in link instead"
2. AJAX action or_send_magic_link fires
3. A secure 48-character token is stored in a transient (15-minute expiry)
4. Email sent with link: https://yoursite.com/?or_magic={token}
5. On click: token validated, user logged in, redirected to dashboard

Security notes:

• Tokens are single-use (deleted immediately on use)
• 15-minute expiry enforced via WordPress transients
• Works via init hook so no page needed