feat: add password reset email

lib/auth.ts

@@ -16,13 +16,23 @@ const BFF_BASE =
 
 export type User = {
   id: string;
-  email: string;
+  /**
+   * Nullable: OAuth users (notably some Facebook accounts) may sign up
+   * without sharing an email. They can fill it in later via `auth.setEmail`.
+   */
+  email: string | null;
   handle: string;
   name: string;
   avatar_url: string | null;
   role: string;
   plan: "free" | "premium";
   email_verified_at: string | null;
+  /**
+   * True when the account has a password hash on file. False for OAuth-only
+   * users who haven't set one yet — the frontend uses this to pick between
+   * the "Change password" modal and the "Set a password" flow.
+   */
+  has_password: boolean;
   created_at: string;
   updated_at: string;
 };
@@ -112,6 +122,32 @@ export const auth = {
   resendVerification: () =>
     authFetch<{ ok: boolean }>("/auth/resend-verification", { method: "POST" }),
 
+  /**
+   * Sets (or replaces) the signed-in user's email. The new address is stored
+   * as unverified and a verification link is mailed out immediately. Used by
+   * the "add your email" prompt for OAuth users who signed up without one.
+   */
+  setEmail: (email: string) =>
+    authFetch<User>("/auth/email", {
+      method: "POST",
+      body: JSON.stringify({ email }),
+    }),
+
+  /**
+   * Replaces the signed-in user's password. The BFF verifies the current
+   * password, hashes the new one, and re-issues the session cookie so this
+   * device stays logged in (every other device is signed out the next time
+   * its JWT is checked).
+   */
+  changePassword: (currentPassword: string, newPassword: string) =>
+    authFetch<User>("/auth/change-password", {
+      method: "POST",
+      body: JSON.stringify({
+        current_password: currentPassword,
+        new_password: newPassword,
+      }),
+    }),
+
   updateProfile: (
     name?: string,
     avatarURL?: string | null,