Verify Indian mobile numbers in two HTTP calls with the NaCaller API

Add mobile-number verification to this app using the NaCaller API.
Miss OTP (missed call) is the main method; Voice OTP (we call the user and read a code) is the fallback.
Full reference: https://nacaller.com/docs — plain-text summary: https://nacaller.com/llms-full.txt

SECRETS — read these carefully
- The API key is in the environment variable NACALLER_KEY (it looks like nck_live_…).
- It is a SERVER secret. Never put it in client code, a VITE_/NEXT_PUBLIC_ variable, or the browser bundle.
  Every NaCaller call must go through my backend (an API route, server action, or edge/serverless function —
  on Supabase use an Edge Function and store the key with `supabase secrets set`).

BASE URL: https://api.nacaller.com/api/verify
AUTH HEADER on every call: Authorization: Bearer <NACALLER_KEY>
Errors are JSON: { "error": "human-readable message" } with a normal HTTP status.

BUILD THESE SERVER ENDPOINTS (names are yours to choose):
1. POST /verify/start { phone }
   - Validate phone: keep the last 10 digits; must match /^[6-9]\d{9}$/ (Indian mobile).
   - Call POST https://api.nacaller.com/api/verify/start with JSON { "phone": "<10 digits>", "reference": "<my user id>" }.
   - Response: { requestId, phone, callNumber, status: "pending", expiresAt, expiresIn, instruction }.
   - Save requestId against the signed-in user/session on the server. Return callNumber, instruction, expiresAt, requestId.
2. GET /verify/status/:requestId
   - Only for a requestId saved for this user. Call GET https://api.nacaller.com/api/verify/status/<requestId>.
   - Response: { requestId, phone, reference, status: "pending" | "verified" | "expired", verified, verifiedAt, expiresAt }.
   - When verified is true, mark this user's phone as verified IN MY DATABASE (server side) and return { verified: true }.
3. POST /verify/voice { phone }   (the fallback)
   - Call POST https://api.nacaller.com/api/verify/start with { "phone", "reference", "method": "voice", "language": "en" } ("hi" for Hindi, "te" for Telugu).
   - Response: { id, method: "voice", status: "calling", expiresAt }. Save id against the user.
   - We ring the number and read a 6-digit code twice. The verification is valid for 10 minutes from /start. Until the user answers, /check returns 400 "not answered yet" (no attempt used) and /status says "pending".
4. POST /verify/check { id, code }
   - Call POST https://api.nacaller.com/api/verify/check with { "id", "code" }.
   - 200 { verified: true, id, phone, reference } → mark the phone verified server side.
   - 400 { verified: false, error, attemptsLeft } → show error and attemptsLeft. 5 attempts max.
   - 410 → code expired; offer to call again.

UI (one screen, mobile first)
- Step 1: a phone input ("Your mobile number", +91 prefix shown, 10 digits) and a "Verify" button.
- Step 2 (missed call): show the instruction text, e.g. "Give a missed call to <callNumber> from <phone>. You can cut the call as soon as it rings."
  Show callNumber large, as a tel: link ("Tap to call") on phones. Show a countdown to expiresAt (5 minutes).
  Poll my status endpoint every 2–3 seconds; stop on verified, expired, or when the user leaves the screen.
  On verified: a success state and continue. On expired: "Time ran out" + a "Try again" button.
- After ~20 seconds on step 2, show a secondary button: "Can't give a missed call? Get a call instead".
  It calls my /verify/voice endpoint, then shows a 6-digit code input (inputmode="numeric",
  autocomplete="one-time-code") with the text "We're calling <phone> now. Enter the 6-digit code you hear."
- Show the API's error message as-is for 400, 402 (out of credits — also log it for me), 429 (too many attempts; ask them to wait).
- Disable buttons while a request is in flight. Never show or log the API key.

OPTIONAL: instead of polling, receive a webhook. NaCaller POSTs JSON
{ event: "verification.verified", requestId, phone, reference, verifiedAt, timestamp } (voice ones also carry method) to my HTTPS callback URL
with header X-MissOTP-Signature = hex HMAC-SHA256 of the RAW request body, keyed with the signing secret in NACALLER_WEBHOOK_SECRET.
Verify it with a constant-time compare against the raw bytes (not re-serialised JSON), reject if timestamp
(milliseconds) is more than 5 minutes old, then reply 2xx. Keep polling as a backup.

Do not invent other NaCaller endpoints or fields. Write the code, then list the env vars I need to set.