Add magic link authentication for secure passwordless login

[Neverdecel]

Summary

• Replace insecure direct email login with magic link authentication flow
• Users now receive a login link via email instead of being logged in immediately
• Prevents unauthorized access - only the email owner can complete login

Changes

File	Description
models/verification.py	Add MAGIC_LINK token type to enum
services/verification.py	Add magic link methods (create, verify, rate limit) with 15-min expiry
api/onboarding.py	Replace login endpoint, add /api/auth/magic/{token} verification
templates/login.html	Two-state UI: email entry → check email with countdown/resend
static/style.css	Styles for new login page states

Security Features

• Single-use tokens: Consumed immediately on verification
• 15-minute expiry: Short window limits exposure
• Hashed storage: Raw token never stored in database
• Rate limiting: 60 seconds between magic link requests
• No email enumeration: Same response for existing/non-existing emails

Testing

1. Navigate to /login
2. Enter a registered email → shows "Check your email" state
3. Click magic link in email → redirected and logged in
4. Click same link again → shows "invalid" error
5. Enter non-existent email → shows same success message (no enumeration)

DevOps Notes

No infrastructure changes required. Uses existing:

• Verification tokens table (same as email verification)
• Resend email service
• No new environment variables needed