feat: account connect

internal/server/server.go

@@ -503,6 +503,7 @@ func (s *Server) setupRouter() {
 			}
 			r.Post("/signup", s.authH.SignUp)
 			r.Post("/login", s.authH.LogIn)
+			r.Post("/verify-login-otp", s.authH.VerifyLoginOTP)
 			r.Post("/logout", s.authH.LogOut)
 			r.Post("/forgot-password", s.authH.ForgotPassword)
 			r.Post("/reset-password", s.authH.ResetPassword)
@@ -520,9 +521,18 @@ func (s *Server) setupRouter() {
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
 				r.Get("/me", s.authH.Me)
+				r.Get("/linked-providers", s.authH.LinkedProviders)
 				r.Post("/email", s.authH.SetEmail)
 				r.Post("/change-password", s.authH.ChangePassword)
 				r.Post("/resend-verification", s.authH.ResendVerification)
+				// Link-provider flow — requires the caller to be signed
+				// in; the state encodes their id so the callback links to
+				// THIS user instead of running the normal sign-in path.
+				// The callback itself is the shared /oauth/{provider}/callback
+				// above — the state's link_user_id field switches behaviour.
+				if s.oauthH != nil {
+					r.Get("/oauth/{provider}/link/start", s.oauthH.LinkStart)
+				}
 			})
 		})