feat(auth): implement password reset, session persistence, and password strength meter

[topsonDev]

Summary

This PR implements four critical authentication improvements:

• Password reset flow (feat(auth): add forgot-password / reset-password flow #432): New /forgot-password and /reset-password pages with error handling
• Session persistence (feat(auth): persist session across hard refresh (token in httpOnly cookie) #433): Switch from localStorage to secure httpOnly cookies
• Password strength meter (feat(auth): show password-strength meter on signup #434): Real-time password strength feedback on signup and password reset
• Login button fix (bug(auth): login form re-enables submit button during in-flight request #435): Prevent duplicate login requests by adding submit guard

Changes Made

#432: Add forgot-password and reset-password flow

• Create /forgot-password page that accepts email and sends reset link
• Create /reset-password page with token validation and password update
• Add password strength meter to reset-password form
• Distinguish between 'email not found' and network errors
• Redirect to login with success confirmation after password reset
• Add 'Forgot password?' link on login page

#433: Persist session across hard refresh with httpOnly cookie

• Switch from localStorage to httpOnly cookie for session storage
• Create API route /api/auth/login to set httpOnly cookie on login
• Create API route /api/auth/signup to set httpOnly cookie on signup
• Create API route /api/auth/session to validate and restore session on page load
• Create API route /api/auth/logout to clear session cookie
• Update session provider to restore session from cookie on mount
• Token expiry automatically redirects to /login via API validation

#434: Add password-strength meter on signup

• Implement inline password strength calculation (weak/fair/strong)
• Display real-time strength indicator as user types
• Show helpful error message when password is below minimum length
• Reuse strength calculation on reset-password form for consistency

#435: Fix login form submit button double-request bug

• Add guard to prevent multiple simultaneous handleSubmit calls
• Early return if already submitting prevents duplicate login requests

Backend Requirements

The backend needs to implement:

• POST /password-reset/request endpoint for initiating password reset
• POST /password-reset/confirm endpoint for confirming password reset with token
• GET /me endpoint should handle Bearer token validation for session restoration

Testing

Manual testing should verify:

• Forgot password flow sends email with reset link
• Reset password with valid token updates password
• Password strength meter shows correct levels (weak/fair/strong)
• Session persists across hard refresh
• Expired token redirects to login
• Rapid login clicks only send one request

Closes #432
Closes #433
Closes #434
Closes #435

[drips-wave]

@topsonDev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@topsonDev is attempting to deploy a commit to the kelly musk's projects Team on Vercel.

A member of the Team first needs to authorize it.

[kelly-musk]

against dev branch not main