Finish the recovery guard only after the password change, mark the change
in the repository so a late userUpdated event is harmless, keep the form
locked after success, carry from through the reset check-email page,
share the password error texts and focus the continue button.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fixed-wording tests for the generic credentials error, redacted toString for
login/register state, shared AuthFailure.isRetryable, autofill context
finished even when the router removes the screen, stricter from validation
(encoded and control-character variants), more widget tests.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
