web: add complete password reset flow with deep link token handling

web/src/app/App.tsx

@@ -12,6 +12,7 @@ import { applyAppearancePreferences, getAppPreferences } from "../utils/preferen
 const PENDING_INVITE_TOKEN_KEY = "bm_pending_invite_token";
 const AUTH_NOTICE_KEY = "bm_auth_notice";
 const PENDING_NOTIFICATION_NAV_KEY = "bm_pending_notification_nav";
+const PENDING_RESET_PASSWORD_TOKEN_KEY = "bm_pending_reset_password_token";
 
 export function App() {
   const accessToken = useAuthStore((s) => s.accessToken);
@@ -69,6 +70,15 @@ export function App() {
     window.history.replaceState(null, "", "/");
   }, []);
 
+  useEffect(() => {
+    const resetToken = extractPasswordResetTokenFromLocation();
+    if (!resetToken) {
+      return;
+    }
+    window.localStorage.setItem(PENDING_RESET_PASSWORD_TOKEN_KEY, resetToken);
+    window.history.replaceState(null, "", "/");
+  }, []);
+
   useEffect(() => {
     const nav = extractNotificationNavigationFromLocation();
     if (!nav) {
@@ -142,7 +152,13 @@ export function App() {
   }, [accessToken, joiningInvite, loadChats, me, setActiveChatId, setFocusedMessage, showToast]);
 
   if (!accessToken || !me) {
-    return <AuthPage />;
+    const pendingResetToken = window.localStorage.getItem(PENDING_RESET_PASSWORD_TOKEN_KEY);
+    return (
+      <AuthPage
+        initialResetToken={pendingResetToken}
+        onResetTokenConsumed={() => window.localStorage.removeItem(PENDING_RESET_PASSWORD_TOKEN_KEY)}
+      />
+    );
   }
   return (
     <>
@@ -200,6 +216,17 @@ function extractNotificationNavigationFromLocation(): { chatId: number; messageI
   return { chatId, messageId };
 }
 
+function extractPasswordResetTokenFromLocation(): string | null {
+  if (typeof window === "undefined") {
+    return null;
+  }
+  const url = new URL(window.location.href);
+  if (!/^\/reset-password\/?$/i.test(url.pathname)) {
+    return null;
+  }
+  return url.searchParams.get("token")?.trim() || null;
+}
+
 function inviteJoinErrorMessage(error: unknown): string {
   const status = getHttpStatusCode(error);
   if (status === 404) {