Sign-in link

Auth.js sends a one-time magic link instead of a password reset. If Resend is not configured, the latest link is shown on the next screen for local preview.