feat(auth): forgot-password wizard on the sign-in screen

[alpha5611331]

Closes #102
Backend counterpart: PowerInterviewAI/backend#54 (land that first - this is written against its API shape)

A three-step wizard at /auth/forgot-password (email -> code -> new password), shaped like the signup one, reached from a "Forgot your password?" link on the sign-in screen.

Why code-based and not an emailed link

A reset link opens the system browser, which has no way to hand a token back to an Electron app without a registered deep-link protocol handler. The code flow keeps the whole interaction in the renderer and reuses the plumbing signup already has.

The part that is easy to get wrong

Step one advances on success alone and never reports "no such account". The backend answers forgot-password identically for a registered and an unregistered address, specifically so the endpoint cannot be used to test who has one. A UI that reported the difference would hand that oracle straight back over the front door, so the copy on step two is conditional: "If an account exists for x@y.z, we sent a reset code to it."

AuthService.forgotPassword resolving true means the request went through, nothing more, and that is stated at every layer it passes through so nobody later "improves" it into an existence check.

Remember-me

AuthService.resetPassword rewrites the stored password when rememberMe is on, guarded exactly the way changePassword guards it. The login form pre-fills from that store, so skipping the write leaves the user staring at a filled-in password that has just stopped working, with nothing on screen explaining why; writing it unguarded puts credentials on disk for someone who did not opt in, which login and logout both take care to avoid.

test/password-reset.test.mjs pins both directions, plus that a rejected reset leaves the store alone - the old password is still the live one in that case.

Smaller calls

• The code step exists so a mistyped code fails there rather than after the user has typed a new password twice.
• The password step says up front that the reset signs them out on every device, because it does.
• The expiry is not restated in the UI. The email carries it from server config, and a number hardcoded in the renderer would silently drift from PASSWORD_RESET_CODE_EXPIRE_MINUTES.
• No auto-login after reset: it lands on /auth/login, the same as signup does.

Verification

pnpm lint, both tsc configs, pnpm build, and pnpm test:main all pass locally (the same set CI runs). 12 new checks in test/password-reset.test.mjs.

Not covered: the wizard has not been driven end to end against a live backend, since the endpoints it calls are still in review on the backend PR.

Base

Cut from origin/main (e4797bb, v1.6.6). Nothing else outstanding against it.

🤖 Generated with Claude Code

[gitar-bot]

Code Review ✅ Approved

Adds a forgot-password wizard to the sign-in screen with a secure email verification flow and test coverage. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}