Implement complete forgot password flow

[devin-ai-integration]

Implement complete forgot password flow

Summary

This PR implements a complete forgot password flow on the login screen based on the provided Figma design. The implementation includes both frontend UI changes and backend API endpoints to handle password reset functionality.

Key Changes:

• Backend: Added reset_token and reset_token_expires fields to User model, plus /auth/forgot-password and /auth/reset-password API endpoints
• Frontend: Updated Login component to show forgot password form with email input, success/error messaging, and return to sign in functionality
• Styling: Added CSS for error/success messages and return button that matches existing design patterns

The flow works as follows: User clicks "Forgot Password" → enters email → receives success message → can return to login form. The backend generates secure reset tokens with 1-hour expiration.

Review & Testing Checklist for Human

• Test complete forgot password flow end-to-end - Click "Forgot Password", enter email, verify success message appears, click "Return to sign in"
• Verify existing login functionality still works - Ensure regular email/password login flow wasn't broken by the changes
• Review database schema migration approach - I had to delete the SQLite database during development to add new columns. Consider if this approach is appropriate for production deployments
• Check password reset token security - Verify that secrets.token_urlsafe(32) is sufficient and tokens expire correctly after 1 hour
• Confirm email sending implementation plan - Currently mocked with console.log, needs real email service integration for production

Test Plan: Start both backend (cd backend && python main.py) and frontend (npm start) servers, navigate to /login, test both forgot password flow and regular login flow.

---

Diagram

%%{ init : { "theme" : "default" }}%%
graph TD
    LoginJS["src/Login.js<br/>React Component"]:::major-edit
    AppCSS["src/App.css<br/>Styles"]:::minor-edit
    MainPY["backend/main.py<br/>FastAPI Routes"]:::major-edit
    DatabasePY["backend/database.py<br/>User Model"]:::major-edit
    
    LoginJS -->|"POST /auth/forgot-password"| MainPY
    LoginJS -->|"uses styles"| AppCSS
    MainPY -->|"queries User model"| DatabasePY
    
    subgraph Legend
        L1[Major Edit]:::major-edit
        L2[Minor Edit]:::minor-edit
        L3[Context/No Edit]:::context
    end

classDef major-edit fill:#90EE90
classDef minor-edit fill:#87CEEB
classDef context fill:#FFFFFF

Loading

Notes

• Email Integration: The send_reset_email() function currently logs to console for demo purposes. Replace with actual email service (SendGrid, AWS SES, etc.) for production
• CORS Configuration: Added localhost:3001 to allowed origins for development testing - review if this should be removed for production
• Database Migration: Used SQLite database recreation during development. Consider proper migration strategy for production databases with existing data
• Link to Devin run: https://app.devin.ai/sessions/4ef99e5c98f54123b1a2484b4689960a
• Requested by: @ben-windsurf

Security Note: The forgot password endpoint intentionally returns the same success message regardless of whether the email exists in the system, following security best practices to prevent email enumeration attacks.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring