Fix SMTP delivery, add password reset and user deletion

SMTP:
- Add connection/greeting/socket timeouts so a stalled Gmail
  connection no longer hangs sign-up
- Wrap sendMail in try/catch and fall back to logging the code
- Derive secure from port (465 implicit TLS vs 587 STARTTLS)
- Strip whitespace from the Gmail app password
- Document SMTP_HOST/SMTP_PORT in .env.example and environment.d.ts

Password reset (new):
- POST /(api)/auth/forgot-password emails a 6-digit code and does
  not reveal whether the address is registered
- POST /(api)/auth/reset-password validates the code, sets the new
  password, verifies the email, and signs the user in
- password_reset_codes table added to seed-db.mjs
- "Forgot password?" flow on the mobile sign-in screen

User deletion (new):
- DELETE /(api)/admin/users/[id], owner-only, blocks self-deletion
- Delete button with confirmation on the dashboard Users page

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/(api)/auth/forgot-password+api.ts

@@ -0,0 +1,61 @@
+import { createHash, randomInt } from "crypto";
+
+import { sql } from "@/lib/db";
+import { sendEmail } from "@/lib/mailer";
+
+const hashCode = (email: string, code: string): string =>
+  createHash("sha256").update(`${email}:${code}`).digest("hex");
+
+export async function POST(req: Request) {
+  const { email } = await req.json();
+
+  if (!email?.trim()) {
+    return Response.json({ error: "Email is required." }, { status: 400 });
+  }
+
+  const normalized = email.trim().toLowerCase();
+
+  try {
+    const users = await sql<{ id: string }>`
+      SELECT id FROM users WHERE email = ${normalized}
+    `;
+
+    // Don't reveal whether the address is registered: always answer the same.
+    if (!users[0]) {
+      return Response.json({ data: { sent: false } });
+    }
+
+    const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
+
+    await sql`
+      INSERT INTO password_reset_codes (email, code_hash, expires_at)
+      VALUES (
+        ${normalized},
+        ${hashCode(normalized, code)},
+        CURRENT_TIMESTAMP + INTERVAL '15 minutes'
+      )
+      ON CONFLICT (email) DO UPDATE SET
+        code_hash = EXCLUDED.code_hash,
+        expires_at = EXCLUDED.expires_at,
+        attempts = 0
+    `;
+
+    const delivered = await sendEmail(
+      normalized,
+      "Reset your Waseel password",
+      `We received a request to reset your Waseel password.\n\nYour reset code is: ${code}\n\nIt expires in 15 minutes. If you didn't ask for this, you can ignore this email.`,
+    );
+
+    return Response.json({
+      data: {
+        sent: delivered,
+        // Without SMTP configured there is nothing to receive, so surface the
+        // code to keep the reset flow usable on a self-hosted box.
+        ...(delivered ? {} : { devCode: code }),
+      },
+    });
+  } catch (error) {
+    console.error("[FORGOT_PASSWORD]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}

app/(api)/auth/register+api.ts

@@ -14,7 +14,7 @@ const hashCode = (email: string, code: string): string =>
   createHash("sha256").update(`${email}:${code}`).digest("hex");
 
 export async function POST(req: Request) {
-  const { name, email, phone, password } = await req.json();
+  const { name, email, phone, password, role } = await req.json();
 
   if (!name?.trim() || !email?.trim() || !password) {
     return Response.json(
@@ -23,6 +23,8 @@ export async function POST(req: Request) {
     );
   }
 
+  const normalizedRole = role === "driver" ? "driver" : "rider";
+
   if (typeof password !== "string" || password.length < 8) {
     return Response.json(
       { error: "Password must be at least 8 characters." },
@@ -44,18 +46,20 @@ export async function POST(req: Request) {
 
     // Unverified rows may be re-registered (e.g. the first mail never arrived).
     await sql`
-      INSERT INTO users (name, email, phone, password_hash, email_verified)
+      INSERT INTO users (name, email, phone, password_hash, email_verified, role)
       VALUES (
         ${name.trim()},
         ${email.trim().toLowerCase()},
         ${phone ? normalizePhone(phone) : null},
         ${hashPassword(password)},
-        FALSE
+        FALSE,
+        ${normalizedRole}
       )
       ON CONFLICT (email) DO UPDATE SET
         name = EXCLUDED.name,
         phone = COALESCE(EXCLUDED.phone, users.phone),
-        password_hash = EXCLUDED.password_hash
+        password_hash = EXCLUDED.password_hash,
+        role = EXCLUDED.role
     `;
 
     const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
@@ -73,13 +77,23 @@ export async function POST(req: Request) {
         attempts = 0
     `;
 
-    await sendEmail(
+    const delivered = await sendEmail(
       email.trim().toLowerCase(),
       "Your Waseel verification code",
       `Welcome to Waseel!\n\nYour verification code is: ${code}\n\nIt expires in 15 minutes.`,
     );
 
-    return Response.json({ data: { sent: true } }, { status: 201 });
+    return Response.json(
+      {
+        data: {
+          sent: delivered,
+          // Without SMTP/Gmail configured there is nothing to receive, so
+          // surface the code to keep self-hosted sign-up usable.
+          ...(delivered ? {} : { devCode: code }),
+        },
+      },
+      { status: 201 },
+    );
   } catch (error) {
     console.error("[REGISTER]: ", error);
     return Response.json({ error: "Internal Server Error" }, { status: 500 });

app/(api)/auth/reset-password+api.ts

@@ -0,0 +1,79 @@
+import { createHash } from "crypto";
+
+import { sql } from "@/lib/db";
+import { hashPassword } from "@/lib/password";
+import { issueSession, toProfile } from "@/lib/users";
+
+const hashCode = (email: string, code: string): string =>
+  createHash("sha256").update(`${email}:${code}`).digest("hex");
+
+export async function POST(req: Request) {
+  const { email, code, password } = await req.json();
+
+  if (!email?.trim() || !/^\d{6}$/.test(code ?? "")) {
+    return Response.json(
+      { error: "Email and a 6-digit code are required." },
+      { status: 400 },
+    );
+  }
+
+  if (typeof password !== "string" || password.length < 8) {
+    return Response.json(
+      { error: "Password must be at least 8 characters." },
+      { status: 400 },
+    );
+  }
+
+  const normalized = email.trim().toLowerCase();
+
+  try {
+    const valid = await sql<{ email: string }>`
+      SELECT email FROM password_reset_codes
+      WHERE email = ${normalized}
+        AND code_hash = ${hashCode(normalized, code)}
+        AND expires_at > CURRENT_TIMESTAMP
+    `;
+
+    if (!valid[0]) {
+      await sql`
+        UPDATE password_reset_codes SET attempts = attempts + 1
+        WHERE email = ${normalized}
+      `;
+
+      return Response.json(
+        { error: "Invalid or expired reset code." },
+        { status: 400 },
+      );
+    }
+
+    // A successful reset also proves control of the mailbox, so verify it too.
+    const rows = await sql<{
+      id: string;
+      name: string;
+      email: string;
+      role: string | null;
+    }>`
+      UPDATE users
+      SET password_hash = ${hashPassword(password)}, email_verified = TRUE
+      WHERE email = ${normalized}
+      RETURNING id, name, email, role
+    `;
+
+    const user = rows[0];
+
+    if (!user) {
+      return Response.json({ error: "User not found." }, { status: 404 });
+    }
+
+    await sql`DELETE FROM password_reset_codes WHERE email = ${normalized}`;
+
+    const session = issueSession(user);
+
+    return Response.json({
+      data: { token: session.token, user: toProfile(user) },
+    });
+  } catch (error) {
+    console.error("[RESET_PASSWORD]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}