P2: fix(auth): explain stale authorization and recovery links

[aspiers]

Summary

Replace raw missing-parameter errors on stale or direct sign-in and recovery visits with actionable guidance. Users are told that the link is no longer usable and how to restart.

Changes

• Add user-facing stale-link responses for authorization and recovery
• Assert visible error wording without matching hidden fields or scripts
• Document both user-facing changes with changesets

Testing

• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm test:coverage

Screenshots

Before: stale sign-in and recovery links exposed the internal request_uri parameter name.

After: both routes give actionable guidance.

Notes

• Focused extraction and review of work originally proposed in [WIP] many usability fixes (needs untangling) #165.
• The deployed E2E suite passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
epds-demo	Ready	Preview	Aug 4, 2026 10:06pm

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab41731f-f08e-4a90-ad71-601ae1562058

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 0232ebf

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[railway-app]

🚅 Deployed to the ePDS-pr-219 environment in ePDS

Service	Status	Web	Updated (UTC)
@certified-app/demo	✅ Success (View Logs)	Web	Aug 4, 2026 at 10:06 pm
@certified-app/demo untrusted	✅ Success (View Logs)	Web	Aug 4, 2026 at 10:06 pm
@certified-app/auth-service	✅ Success (View Logs)	Web	Aug 4, 2026 at 10:06 pm
@certified-app/pds-core	✅ Success (View Logs)	Web	Aug 4, 2026 at 10:06 pm

[coveralls-official]

Coverage Report for CI Build 30955033531

Coverage remained the same at 57.909%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• 4 coverage regressions across 2 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

4 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
packages/auth-service/src/routes/login-page.ts	2	81.64%
packages/auth-service/src/routes/recovery.ts	2	11.41%

---

Coverage Stats

Relevant Lines:	3106
Covered Lines:	1789
Line Coverage:	57.6%
Relevant Branches:	1945
Covered Branches:	1136
Branch Coverage:	58.41%
Branches in Coverage %:	Yes
Coverage Strength:	9.78 hits per line

---

💛 - Coveralls

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud