Add stage 8: passwordless magic-link login

Backend
- POST /api/auth/magic-link (public): emails a one-time login link for an
  address. Always 202 with the same body so accounts can't be enumerated; a
  link is sent only when the account exists and wasn't emailed in the last
  60s. Opening it (existing verify-email endpoint) returns a session and, as a
  side effect, verifies the address. New EmailVerifier::sendLoginLink; the
  60s interval is now EmailVerifier::RESEND_INTERVAL_SECONDS, shared.

Frontend
- LoginView defaults to magic-link mode: email only, "Log in with email". A
  "Log in with password" link reveals the password field, changes the button
  to "Log in", and itself becomes "Get a magic link" to switch back.
- VerifyEmailView copy is now login-neutral ("Signing you in").

Tests: 5 new (magic-link login, implicit verification, enumeration-safety,
throttle, validation). Suite: 37 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/AuthController.php

@@ -70,6 +70,37 @@ final class AuthController extends Controller
         return $this->json($response, $this->session->forUser($user));
     }
 
+    /**
+     * POST /api/auth/magic-link  (public)
+     *
+     * Emails a one-time login link for the given address. Always responds the
+     * same way so registered addresses can't be enumerated; a link is only sent
+     * when the account exists and hasn't been sent one in the last minute.
+     * Opening the link signs the user in and verifies the address.
+     */
+    public function requestLoginLink(Request $request, Response $response): Response
+    {
+        $body = (array) ($request->getParsedBody() ?? []);
+        $email = is_string($body['email'] ?? null) ? mb_strtolower(trim($body['email'])) : '';
+
+        if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > self::EMAIL_MAX) {
+            throw new ValidationException(['email' => ['Enter a valid email address.']]);
+        }
+
+        $user = $this->users->findByEmail($email);
+        if ($user !== null && !$this->recentlyEmailed($user)) {
+            try {
+                $this->verifier->sendLoginLink($user);
+            } catch (MailException $e) {
+                error_log('Login link failed for user ' . $user['id'] . ': ' . $e->getMessage());
+            }
+        }
+
+        return $this->json($response, [
+            'message' => 'If that address has an account, a login link is on its way.',
+        ], 202);
+    }
+
     /**
      * GET /api/me  (requires AuthMiddleware)
      */
@@ -78,6 +109,17 @@ final class AuthController extends Controller
         return $this->json($response, ['user' => $this->session->present($this->user($request))]);
     }
 
+    /**
+     * @param array{verification_email_sent_at?: string|null} $user
+     */
+    private function recentlyEmailed(array $user): bool
+    {
+        $lastSent = $user['verification_email_sent_at'] ?? null;
+
+        return $lastSent !== null
+            && (time() - (int) strtotime($lastSent)) < EmailVerifier::RESEND_INTERVAL_SECONDS;
+    }
+
     /**
      * Extract and validate the email/password pair from the request body.
      *