feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/(auth)/forgot-password/page.tsx

@@ -2,36 +2,25 @@
 
 import { useState } from 'react'
 import Link from 'next/link'
-import { createClient } from '@/lib/supabase/client'
 
 export default function ForgotPasswordPage() {
   const [email, setEmail] = useState('')
   const [loading, setLoading] = useState(false)
   const [submitted, setSubmitted] = useState(false)
-  const [error, setError] = useState<string | null>(null)
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
     if (!email) return
     setLoading(true)
-    setError(null)
 
-    const supabase = createClient()
-    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? ''
-    const redirectTo = `${appUrl}/api/auth/callback?next=/reset-password`
-
-    const { error: resetError } = await supabase.auth.resetPasswordForEmail(email, {
-      redirectTo,
+    await fetch('/api/auth/reset-request', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
     })
 
     setLoading(false)
-
-    if (resetError) {
-      setError('Something went wrong. Please try again.')
-      return
-    }
-
-    // Always show success — never reveal whether email exists
+    // Always show "check your email" regardless of response (silent for non-existent users)
     setSubmitted(true)
   }
 
@@ -61,12 +50,6 @@ export default function ForgotPasswordPage() {
           </p>
         </div>
 
-        {error && (
-          <p className="bg-red-50 border border-red-200 text-red-700 text-sm rounded px-3 py-2">
-            {error}
-          </p>
-        )}
-
         <input
           type="email"
           placeholder="Email"