Finish the recovery guard only after the password change, mark the change
in the repository so a late userUpdated event is harmless, keep the form
locked after success, carry from through the reset check-email page,
share the password error texts and focus the continue button.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- expose legal links to screen readers on web
- allow only http(s) legal URLs, prevent double submit
- detect transport errors without runtimeType, keep extra in memory
- ship third-party license text, document decisions
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>