If no file exists, we auto-generate; otherwise we serve the last good file. No tokens required.
Phone numbers normalized to E.164 (NG by default) with Do-Not-Contact checks.
Consent logs, CSRF protections, and sensible security headers across the app.