feat(auth): add password recovery flow (#233)

[raza-khan0108]

Summary

Implements the password recovery flow requested in #233.

No backend changes are required — SuperTokens natively handles password reset token generation and validation via its ThirdPartyEmailPassword recipe.

Changes

LoginPage.tsx

• Activated the dormant forgot_password mode that was already typed in state but never rendered
• Added a "Forgot password?" link that appears below the sign-in toggle when using email login
• Shows a forgot-password panel (email input + "Send Reset Email" button) when the link is clicked
• Displays a success confirmation alert after the email is sent
• Calls ThirdPartyEmailPassword.sendPasswordResetEmail() from the SuperTokens SDK
• Removed unused clsx import

ResetPasswordPage.tsx (new file)

• New page rendered at /login/reset-password — SuperTokens automatically reads the ?token= query param from the reset email link
• Shows a new password + confirm password form with the same strong-password validation used in sign-up
• Three animated outcome states:
  • ✅ Success — confirmation card + "Go to Sign In" button
  • ❌ Invalid/Expired token — warning card + "Request New Link" CTA back to /login
  • 🚨 Generic error — destructive alert displayed inline

app.tsx

• Registered /login/reset-password as a public (non-authenticated) route alongside /login and /logout

How to Test

1. Go to /login and expand the email sign-in form
2. Click "Forgot password?" → verify the forgot-password panel appears with an email input
3. Submit a valid email → verify the "Email sent!" confirmation alert appears
4. Click the reset link from the received email → verify /login/reset-password?token=... loads correctly
5. Enter and confirm a new password → verify redirect to /login on success
6. Test with a tampered or expired token → verify the "Link expired or invalid" error card appears with a "Request New Link" button

Notes

⚠️ SuperTokens must be configured with an SMTP provider to deliver the reset email. This is configured out-of-band on the SuperTokens server — no application code changes are needed for email delivery.

Related

Closes #233

[overcut-ai]

❌ Workflow Failed: "Code Review"

The workflow encountered an error and could not complete successfully.

Error: Step git-clone failed

---

👉 View complete log

[Copilot]

The job was not started because the account is locked due to a billing issue.