fix(auth): add forgot/reset to public routes, use Link for basePath, add session guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

app/(auth)/reset-password/page.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useState } from 'react'
+import { useState, useEffect } from 'react'
 import { useRouter } from 'next/navigation'
 import Link from 'next/link'
 import { createClient } from '@/lib/supabase/client'
@@ -11,6 +11,14 @@ export default function ResetPasswordPage() {
   const [confirm, setConfirm] = useState('')
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const [sessionReady, setSessionReady] = useState<boolean | null>(null)
+
+  useEffect(() => {
+    const supabase = createClient()
+    supabase.auth.getSession().then(({ data: { session } }) => {
+      setSessionReady(!!session)
+    })
+  }, [])
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
@@ -31,20 +39,36 @@ export default function ResetPasswordPage() {
     setLoading(false)
 
     if (updateError) {
-      if (
-        updateError.message.toLowerCase().includes('session') ||
-        updateError.message.toLowerCase().includes('expired')
-      ) {
-        setError('Reset link has expired. Request a new one.')
-      } else {
-        setError(updateError.message)
-      }
+      setError('Reset link has expired. Request a new one.')
       return
     }
 
     router.push('/login?message=password_reset')
   }
 
+  if (sessionReady === null) {
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
+        <p className="text-sm text-gray-500">Loading…</p>
+      </div>
+    )
+  }
+
+  if (!sessionReady) {
+    return (
+      <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
+        <div className="w-full max-w-sm text-center space-y-3">
+          <p className="bg-red-50 border border-red-200 text-red-700 text-sm rounded px-3 py-2">
+            Reset link has expired or is invalid.
+          </p>
+          <Link href="/forgot-password" className="text-sm text-blue-600 hover:underline">
+            Request a new reset link
+          </Link>
+        </div>
+      </div>
+    )
+  }
+
   return (
     <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
       <form onSubmit={handleSubmit} className="flex flex-col gap-4 w-full max-w-sm">