Why
Once registration stops auto-issuing tokens for unconfirmed accounts, the frontend can't assume "register succeeded" means "go into the app."
This chunk
- Signup flow: if
POST /api/auth/register returns no tokens (unconfirmed path), show a "check your email" screen instead of redirecting in — resend button calling POST /api/auth/resend-verification, with a client-side cooldown to prevent button-mashing.
- New
/verify-email route: reads ?token= on mount, calls the verify endpoint, on success stores tokens and redirects in like a normal login; on failure (expired/invalid) shows an error state with a link back to resend.
- Update the register form/session handling to branch on the new response shape from PR-V1.
Builds on the verify/resend endpoints from PR-V2.
Why
Once registration stops auto-issuing tokens for unconfirmed accounts, the frontend can't assume "register succeeded" means "go into the app."
This chunk
POST /api/auth/registerreturns no tokens (unconfirmed path), show a "check your email" screen instead of redirecting in — resend button callingPOST /api/auth/resend-verification, with a client-side cooldown to prevent button-mashing./verify-emailroute: reads?token=on mount, calls the verify endpoint, on success stores tokens and redirects in like a normal login; on failure (expired/invalid) shows an error state with a link back to resend.Builds on the verify/resend endpoints from PR-V2.