[Magic Links] Infrastructure #571

Summary

Implement magic link authentication as a passwordless alternative.

Background

Schema already supports magic_link type in verificationTokens. Need service + routes.

New Files

• packages/lib/src/auth/magic-link-service.ts
• apps/web/src/app/api/auth/magic-link/send/route.ts
• apps/web/src/app/api/auth/magic-link/verify/route.ts

Flow

1. User enters email → rate-limited token generation
2. Email sent with ps_magic_* token (5-min expiry)
3. Click link → validate token → create session → redirect to app
4. Token is one-time use (marked usedAt on consumption)

Technical Details

• Token format: ps_magic_${randomBytes(32).toString('hex')}
• Rate limiting: 3 requests per email per 15 minutes
• Expiry: 5 minutes
• One-time use enforcement
• Existing user: log in
• New user: create account + log in

Acceptance Criteria

• Magic link service with send/verify methods
• API routes for send and verify
• Rate limiting implemented
• Email template for magic link
• Token expiry enforced
• One-time use enforced
• Unit tests for magic link service