Scanner-safe email links: land on a page, consume the token on POST

[pataniaeli]

Ticket: AUTH-T103 · Epic: E3 Authentication Core · Phase: Phase 1 — Core auth, sessions, SSO (MVP)
Priority: Urgent · Estimate: 2 points · Labels: epic:auth-core, phase:1, backend, email, security

Depends on:

• Email infrastructure: Resend on a dedicated SGAuth sending domain with volume caps #32 — AUTH-T20 Email infrastructure: Resend on a dedicated SGAuth sending domain with volume caps

Northeastern mail is Microsoft 365, and Defender Safe Links pre-fetches every link in incoming mail. A link that acts on GET (verify, reset, invite/set-password, unlock, PA transfer accept/cancel) would be consumed by the scanner before the user clicks. Rule for every emailed link in SGAuth: the URL opens a page that shows what is about to happen and a button; the token is validated for display on GET (never consumed, never marks anything) and consumed only on the button's POST (same-origin, CSRF-protected). Better Auth's built-in verify-email link acts on GET, so send our own URL (/verify-email?token=) that renders the confirmation page and calls the Better Auth verification endpoint on submit. HEAD requests and known scanner user agents get a 200 with no side effects. Provide one shared TokenActionPage component and a helper used by AUTH-T18, T19, T22, T24, T37, T64.

Acceptance criteria

• A HEAD or GET request to any emailed link does not consume the token (integration test); the subsequent POST does, exactly once.
• Every email template's link points at a page implementing the pattern (test enumerates templates).

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}