fix(auth): add forgot/reset to public routes, use Link for basePath, add session guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

components/auth/login-form.tsx

@@ -3,6 +3,7 @@
 
 import { useState } from 'react'
 import { useRouter } from 'next/navigation'
+import Link from 'next/link'
 import { createClient } from '@/lib/supabase/client'
 
 export function LoginForm() {
@@ -68,9 +69,9 @@ export function LoginForm() {
         {loading ? 'Signing in…' : 'Sign in'}
       </button>
       <p className="text-center text-sm text-gray-500">
-        <a href="/forgot-password" className="text-blue-600 hover:underline">
+        <Link href="/forgot-password" className="text-blue-600 hover:underline">
           Forgot password?
-        </a>
+        </Link>
       </p>
     </form>
   )