Implement email magic-link authentication

internal/auth/ provides:
- TokenStore: 32-byte cryptographically random one-time tokens.
  Only the SHA-256 hash is persisted (so a DB leak doesn't grant
  active sessions). Comparison uses subtle.ConstantTimeCompare.
  Single-use is enforced via UPDATE ... WHERE used_at IS NULL.
- Signer: HS256 JWTs with 24h lifetime, jwt.WithValidMethods to
  reject alg=none and other downgrade attacks.
- LogMailer (dev) and SMTPMailer (prod via net/smtp) behind a
  Mailer interface.
- RateLimiter: DB-backed fixed window per email; default 5 per
  15 min for the magic-link flow.
- Service: orchestrates RequestLogin (auto-creates user on first
  login, generates token, emails magic link) and Verify (consumes
  token, updates last_login, issues JWT).
- Handlers: POST /auth/login and GET/POST /auth/verify.
  HandleLogin returns 202 even on validation failure to avoid
  account enumeration; rate-limit hits surface as 429.

Schema additions: magic_tokens (with FK + cascade) and
login_attempts. UserStore.SetStoragePath added for completeness.

Tests cover: token issue/consume, single-use, expiry, rate limit,
JWT round-trip, alg=none rejection, signature tampering, purge,
HTTP handlers (login + verify, missing/invalid token paths).

Closes #9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/auth/handlers.go

@@ -0,0 +1,83 @@
+package auth
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+)
+
+// Handlers exposes HTTP handlers for the magic-link login flow.
+type Handlers struct{ Service *Service }
+
+// LoginRequest is the JSON body for POST /auth/login.
+type LoginRequest struct {
+	Email string `json:"email"`
+}
+
+// HandleLogin accepts an email and triggers a magic-link send. It
+// always returns 202 even when the email is unknown or rate-limited
+// for clients we want to expose; we return distinguishable errors only
+// for malformed input. This avoids account-enumeration leaks.
+func (h Handlers) HandleLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	var req LoginRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1024)).Decode(&req); err != nil {
+		http.Error(w, "invalid body", http.StatusBadRequest)
+		return
+	}
+	err := h.Service.RequestLogin(r.Context(), req.Email)
+	switch {
+	case err == nil:
+	case errors.Is(err, ErrRateLimited):
+		// Surface rate limiting as 429 — the email is known to the
+		// client (they sent it) so we don't leak account existence.
+		http.Error(w, "rate limited", http.StatusTooManyRequests)
+		return
+	default:
+		// Any other failure is internal; mask details.
+		// In particular, validation failures look the same as success
+		// to the client; we still log the actual error server-side.
+		w.WriteHeader(http.StatusAccepted)
+		_, _ = w.Write([]byte(`{"status":"sent"}`))
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusAccepted)
+	_, _ = w.Write([]byte(`{"status":"sent"}`))
+}
+
+// VerifyResponse is the JSON body returned by GET /auth/verify on success.
+type VerifyResponse struct {
+	JWT     string `json:"jwt"`
+	UserID  string `json:"user_id"`
+	Email   string `json:"email"`
+	Expires int64  `json:"expires_at"`
+}
+
+// HandleVerify validates a magic-link token and issues a session JWT.
+func (h Handlers) HandleVerify(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	token := r.URL.Query().Get("token")
+	if token == "" {
+		http.Error(w, "missing token", http.StatusBadRequest)
+		return
+	}
+	res, err := h.Service.Verify(r.Context(), token)
+	if err != nil {
+		http.Error(w, "invalid or expired token", http.StatusUnauthorized)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(VerifyResponse{
+		JWT:     res.JWT,
+		UserID:  res.User.ID,
+		Email:   res.User.Email,
+		Expires: nowFn().Add(SessionLifetime).Unix(),
+	})
+}