A workaround I am considering that will solve two out of three of my problems: Use Firebase SMS authentication
This will produce an OIDC ID token that can be used with Firebase directly and covers the passwordless.
I am then looking at a mechanism to exchange the Firebase ID token for an Auth0 API access token along these lines: draft-ietf-oauth-token-exchange-03