[jm-rivera]

Adds sign-in by emailed code to /login through Better Auth's emailOTP plugin. Google, GitHub and Microsoft stay first, and a quiet "Use email instead" toggle opens an email field and only then loads Turnstile. The six-digit code lasts 10 minutes, allows three wrong tries, works once, and is stored encrypted under the auth secret. The first code sign-in for an address creates the account. It builds on #27's shared limiter.

Every send passes Cloudflare Turnstile, is refused for throwaway domains (disposable-email-domains-js), and counts against 5 codes per inbox and 20 per network each hour in #27's limit_counter (src/lib/auth/codeLimit.ts), on the bounded counterDb pool the other counters use. A send refused by either cap gives back its hit on both. The unused emailOTP endpoints are disabled, and a send that fails answers 503 CODE_NOT_SENT, where Better Auth alone would report success.

src/lib/auth/clientIp.ts sets x-dfo-client-ip on /api/auth requests from the trusted X-Forwarded-For entry (TRUSTED_PROXY_HOPS), and Better Auth's rate limiter, Turnstile and the caps read it. Behind Cloud Run, Better Auth's default put every visitor in one rate-limit bucket.

Two changes touch existing sign-in. trustedProviders is gone, so Google and GitHub link to an existing user only when they mark the address verified. safeNext (src/lib/auth/nextPath.ts) keeps next only when it resolves on this site, which closes /\evil.example.

Deployed, mail goes through the Amazon SES v2 API with no AWS secret (src/lib/mail/ses.ts). AWS STS trades the Cloud Run service account's Google ID token, minted for the audience in SES_TOKEN_AUDIENCE, for temporary credentials for the role in SES_ROLE_ARN. ONE's AWS account has one sender role per environment, each requiring its own audience, and DevelopmentFinanceObservatory/infra#48 sets all three SES values for dev and prod. Each request times out at 10 seconds and is tried twice. SMTP_HOST selects SMTP for local work. Email sign-in stays off until SES_ROLE_ARN, SES_REGION and SES_TOKEN_AUDIENCE (or SMTP_HOST), AUTH_EMAIL_FROM and both Turnstile keys are set, so this can merge before the Turnstile secret keys are in Secret Manager. Failed database queries log their parameters across the site, which needs its own PR.

Testing: typecheck, ESLint and pnpm build pass, and pnpm test passes 1723 of 1723 on Postgres 18.4. Wiring tests run a real Better Auth with a stub Turnstile server and cover each refusal, encrypted storage, single use, the try limit and a failed send. A wire test runs the SES transport against a local STS and SES and checks one token mint for two sends, the configured audience, the signing key and region, and a timeout after two attempts. On next dev, a code sent through a local SMTP server signed in, and in SES mode off Cloud Run a send answered 503 CODE_NOT_SENT. No mail has gone through real SES yet.

Screenshots

Before is #27's branch and after is this branch, both on next dev at 1440 by 900.

Change	Before	After
Sign-in card
Email form open	New
Code sent	New