feature(auth): safe email verification resend recovery flow

[ben-fornefeld]

Summary

• add resendSignupVerificationAction with enumeration-safe behavior
• add KV cooldown guard for resend requests
• refactor auth recovery states to focused recovery-only mode (hide full auth form)
• show recovery-only resend flow for expired-link and unconfirmed-email states
• add integration coverage for resend success/cooldown/error/validation

Screenshots (Preview build)

Recovery mode: sign-up verification state

Recovery mode: sign-in expired-link state

Recovery mode: resend success + cooldown

Recovery mode: sign-in unconfirmed-email state

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview, Comment	Apr 30, 2026 1:41am
web-juliett	Ready	Preview, Comment	Apr 30, 2026 1:41am

[cursor]

PR Summary

Medium Risk
Touches authentication recovery flow and introduces a new server action with rate-limiting and header-derived fingerprinting; mistakes could affect resend availability or user navigation but should not expose account existence.

Overview
Adds a new resendSignupVerificationAction that resends Supabase signup verification emails while remaining enumeration-safe, including a KV-based 60s cooldown keyed by hashed email and requester fingerprint and always returning success (logging provider/KV errors instead).

Updates the sign-in and sign-up pages to switch into a focused recovery view (new RecoveryView + ResendVerificationForm) when email confirmation is required or the verification link is expired, and adds new copy (USER_MESSAGES.signUpVerificationResend) plus integration tests covering resend success, cooldown short-circuit, provider error, and validation.

^{Reviewed by Cursor Bugbot for commit a5ac297. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a198dfa. Configure here.}