Accounts, sessions and sign-in

Accounts are now self-hosted and hardened: sessions persist until you log out, sign-in works with a provider as well as a password, and confirmation email is delivered through a real transport.

Added

• Sign in with Google or GitHub. A provider account links to an existing address instead of creating a duplicate, and can add a password later from settings.
• Confirmation, password-reset and email-change links are sent through Resend when configured, and logged locally when not.
• Sliding session renewal: an active session is reissued on use, so you stay signed in until you choose to log out.
• Set-password flow for accounts that were created through a provider.

Changed

• Rate limiting extended to the OAuth start and callback endpoints and to logout.
• Account copy and deletion notices rewritten for Beyonders; provider-only accounts are told how to sign in rather than shown a bare error.

Security

• Password verification runs a full derivation even for accounts with no password, so response time does not reveal whether an address has one.