fix(auth): stop drawing a reset form the link can no longer fill (E9.5 S4)

Reported from UAT: delete an account, then open its password-reset link. The card drew the full "set
a new password" form — because a `#reset=` fragment was present, and nothing more — and only after
the user had typed a password did the server answer 400. Measured first: no security hole. A user's
tokens cascade away with the row, so nothing can be set on a deleted or a re-created account. What
was left is a dead end of exactly the kind this epic exists to remove, and it is not rare: a reset
link lives one hour, mail is slow or lands in spam, and whoever got two mails clicks the older one.

password-reset/check answers whether a link is still usable WITHOUT spending it, so asking can never
cost the user their one real attempt — the property the tests pin hardest. It gets its own limiter,
because opening a link must not eat the budget for requesting one, and a throttled caller is told
"ok", never "dead": this check may only ever save someone a wasted form, so when it cannot answer it
degrades to the old behaviour instead of declaring a live link finished. The confirm endpoint stays
the authority, and its failure raises the same named screen, since the token can die between the two
calls or the probe itself may have failed.

A too-short password is deliberately NOT that screen. The length check runs before the token is
spent, so a typo costs the link nothing, and the card tells the two 400s apart by `reason` so only
one of them takes the form down.

Both email-link confirmations (verify, password-reset/confirm) now answer in the {code, reason}
shape S4 introduced. They were the last refusals a user meets by simply clicking an old link while
still being answered in hardcoded English under a bilingual UI. The seven remaining bare strings in
this module (register, request-access, the demo guards, set-password) sit behind client-side
validation the UI does first; they are logged as a follow-up rather than swept in silently here.

One bug found by the UAT itself, in the new code: the check went out FOUR times per opened link —
StrictMode double-invokes effects and the shell remounts the card as the session probe settles.
Harmless per request, but against a per-IP limit it would exhaust the budget in two reloads and then
silently fall back to drawing the form unchecked: nothing errors, the feature just stops working.
Deduped in a module-level map holding the in-flight promise (a ref dies with the remount that causes
it); a failed probe drops itself so a blip is never cached as "dead". The test renders the card
twice, because with one render the guard would rot undetected.

UAT on localdev: the reported scenario end to end (delete the account, open the link) shows the named
screen and no form; a live link still opens the form and completes; the CTA lands on the request-a-
link form; one probe per opened link. Throwaway accounts removed.

backend/tests/test_reset_link_states.py

@@ -0,0 +1,90 @@
+"""What a dead email link says, and what it costs to ask (E9.5 S4 follow-up), DB-lane.
+
+Reported 2026-09-05: delete an account, then open its password-reset link. The card drew a full
+"set a new password" form — because a `#reset=` fragment was present, nothing more — and only after
+the user typed a password did the server answer 400. No security hole (the account's tokens cascade
+away with it, so nothing can be set on a deleted or a re-created account), but a dead end of exactly
+the kind this epic exists to remove.
+
+The fix is a check that does NOT spend the token, so the pre-flight can never cost the user their
+one real attempt. That is the property most worth pinning here.
+"""
+
+from app.routes.auth import RESET_TTL, _issue_token
+
+_PW = "correct horse battery"
+_NEW = "brand new password"
+
+
+def _issue(db, user):
+    raw = _issue_token(db, user, "reset", RESET_TTL)
+    db.commit()
+    return raw
+
+
+def test_checking_a_live_link_does_not_spend_it(client, db, make_user):
+    raw = _issue(db, make_user(email="live@example.com", password=_PW))
+
+    assert client.post("/auth/password-reset/check", json={"token": raw}).json() == {"ok": True}
+    assert client.post("/auth/password-reset/check", json={"token": raw}).json() == {"ok": True}
+
+    # The whole point: after any number of checks the one real attempt is still there.
+    assert client.post(
+        "/auth/password-reset/confirm", json={"token": raw, "password": _NEW}
+    ).json() == {"ok": True}
+
+
+def test_a_link_whose_account_was_deleted_is_reported_dead(client, db, make_user):
+    user = make_user(email="gone@example.com", password=_PW)
+    raw = _issue(db, user)
+    db.delete(user)
+    db.commit()
+
+    assert client.post("/auth/password-reset/check", json={"token": raw}).json() == {"ok": False}
+
+    # And the confirm agrees, in the structured shape the card renders as a named screen — the two
+    # must never disagree about one token.
+    r = client.post("/auth/password-reset/confirm", json={"token": raw, "password": _NEW})
+    assert r.status_code == 400
+    assert r.json()["detail"] == {"code": "reset", "reason": "invalid"}
+
+
+def test_a_spent_link_is_reported_dead(client, db, make_user):
+    raw = _issue(db, make_user(email="spent@example.com", password=_PW))
+    client.post("/auth/password-reset/confirm", json={"token": raw, "password": _NEW})
+
+    assert client.post("/auth/password-reset/check", json={"token": raw}).json() == {"ok": False}
+
+
+def test_a_too_short_password_does_not_burn_the_link(client, db, make_user):
+    raw = _issue(db, make_user(email="short@example.com", password=_PW))
+
+    r = client.post("/auth/password-reset/confirm", json={"token": raw, "password": "short"})
+
+    assert r.status_code == 400
+    assert r.json()["detail"]["reason"] == "weak_password"
+    # A mistyped password must not cost the link — the length check runs BEFORE the token is spent,
+    # and the card tells the two failures apart by `reason` so only one of them takes the form down.
+    assert client.post(
+        "/auth/password-reset/confirm", json={"token": raw, "password": _NEW}
+    ).json() == {"ok": True}
+
+
+def test_a_dead_verification_link_answers_in_the_same_structured_shape(client):
+    r = client.post("/auth/verify", json={"token": "no-such-token"})
+
+    assert r.status_code == 400
+    assert r.json()["detail"] == {"code": "verify", "reason": "invalid"}
+
+
+def test_the_check_never_reports_a_live_link_dead_when_throttled(
+    client, db, make_user, monkeypatch
+):
+    from app.routes import auth as auth_routes
+
+    raw = _issue(db, make_user(email="throttled@example.com", password=_PW))
+    monkeypatch.setattr(auth_routes._reset_check_limiter, "allow", lambda _ip: False)
+
+    # Fail OPEN. This check may only ever save a wasted form; a throttled probe that answered "dead"
+    # would lock someone out of a link that works.
+    assert client.post("/auth/password-reset/check", json={"token": raw}).json() == {"ok": True}