[FEATURE] - PR3 : Web auth

[pulk17]

[FEATURE]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

Signing in, recovering a password, and managing your own account. Depends on #1197.

What's here
The sign-in card, the standalone reset screen, and the account page (display name, email, password, GitHub connection, closing the account).

Account enumeration
Both the "forgot password" and "create an account" flows return the same confirmation whether or not the address exists - "If that address has an account, a reset link is on its way." That's intentional and matches what the API does; a different answer would let an anonymous caller discover who's registered.

What still finishes on the classic pages
Signup. complete_signup is the only place a User row is created, and duplicating that felt like the wrong trade. The console requests the link; the classic page completes it.

Password reset can move here, and does once CONSOLE_URL is set (PR 9). Until then the email keeps pointing at /account/reset.

GitHub
Connecting is an OAuth redirect that finishes on the platform's existing callback, so the console sends you there and picks up the result afterwards rather than handling the exchange itself. Disconnecting only clears the platform's stored token - the note in the UI says so, since the authorisation itself has to be withdrawn from GitHub.

Review notes
Changing your email requires the current password; changing your name doesn't. The minimum password length isn't duplicated in the frontend - the server reports it, so there's no second number to keep in sync.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud