Password reset email link leads to broken page (missing /reset-password route)

[dtch1997]

Bug

When a user requests a password reset, the email is sent successfully, but clicking the reset link doesn't work. The link redirects to /reset-password, which has no corresponding route in the React app — the user either sees a 404 or gets redirected to the login page without the recovery token being processed.

Root Cause

• AuthContext.tsx calls supabase.auth.resetPasswordForEmail(email) with redirectTo: '${window.location.origin}/reset-password'
• App.tsx has no /reset-password route defined
• There is no ResetPassword component to handle the recovery token and accept a new password

Fix

1. Create a ResetPassword component that:
   • Detects the Supabase recovery session from the URL fragment
   • Shows a form for the user to enter a new password
   • Calls supabase.auth.updateUser({ password }) to complete the reset
2. Add a /reset-password route in App.tsx