Daniel e58aa1b996 refactor: sign-in codes and registration invitations leave; the SSO has both ... Sign-in is email → code at sso.pedshub.com, and new accounts come from an invitation link minted there, so the app's own code emails and invite codes recorded a path nobody can take. Gone: the login-code routes and their rate limiters, the invite admin API and card, the invite field on the register form, the "email me a code / use my password" choice on the sign-in screen (an email now leads straight to the password), both utility modules, and the invite-only setting. A migration drops login_codes and registration_invites. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-13 06:11:00 +02:00
..
tests	refactor: sign-in codes and registration invitations leave; the SSO has both	2026-09-13 06:11:00 +02:00
fixtures.js	test(e2e): drive My Resources through the browser, and assert what it sends	2026-09-12 01:51:15 +02:00
package-lock.json
package.json
playwright.config.js	test: e2e runs against its own throwaway database, not production's	2026-09-13 00:49:25 +02:00
seed.js	refactor: sign-in codes and registration invitations leave; the SSO has both	2026-09-13 06:11:00 +02:00