Fix broken magic link, password sign-in, and missing forgot-password; OTP codes in email now only shown for MCP/OAuth flows

Sign-in now works reliably across all three paths. Clicking a magic link no longer loops back silently to a blank sign-in page — expired or already-used links show a clear "Sign-in link expired or already used" message instead. Password sign-in correctly reports "email not confirmed" when an account hasn't been verified yet, with a one-click "Resend confirmation email" option. A new "Forgot password?" link in password mode triggers a reset email via Resend. Magic-link emails sent for plain web sign-ins now contain only the clickable button — the 6-digit OTP code is included only when connecting an MCP client through the OAuth consent screen, where you actually need to type it in.