2556bde8

By: Michael Lynch <git@mtlynch.io>

Make dev/prod login branching explicit, fix prod token leak

loginPost overloaded a single token-presence check to encode two unrelated
decisions: whether the email was registered, and whether to redirect to the
magic link (dev) or email it (prod). Because both dev and prod token creators
return a real token for registered users, prod fell into the redirect branch,
leaking the login token in the URL and bypassing email entirely.

Separate the two decisions:
- Handle ErrUnregisteredEmail explicitly by rendering the same confirmation
  page as a successful send, instead of subtly zeroing the entry.
- Gate the dev "redirect to magic link" behavior on an explicit build-tagged
  skipLoginEmail flag plumbed through ServerParams, so prod never redirects to
  the token.

Add TestLoginPostDoesNotLeakTokenInProdMode as a regression test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Timeline