Mobile is prefilled from the logged-in user's cookie (userInfo.mobile_number) and rendered read-only; removed it from editable form state/validation and send that number in the claim body. Backend already enforces it must match the account, so the field can't diverge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>