The login links that died before anyone clicked
Confirmation emails worked in every test, but a user reported dead links. Mail apps pre-fetch links to scan them, which used up the single-use token before the person tapped it. I moved verification behind an explicit button click, and added a test mode that routes all outgoing email to one inbox.


