f3aa7c71

By: Michael Lynch <git@mtlynch.io>

Return redirect path from LoginTokenCreator instead of login token entry

LoginTokenCreator now returns a RedirectPath that explicitly tells the
handler where to send the user after login submission. Dev creator
redirects to /login/confirm?token=..., prod creator redirects to
/login/check-email. The POST handler always redirects (POST-Redirect-GET).

Add GET /login/check-email route for the "check your email" page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>