New route /forgot-password with a custom Clerk reset flow (reset_password_email_code strategy): email → 6-digit code → new password → auto sign-in
Sign-in page now exposes a visible "Forgot your password?" link beneath the <SignIn> widget; Clerk's bundled link is hidden whenever multiple first-factors are enabled, so we surface it ourselves
Uses the App Router useSignIn from @clerk/nextjs (signal-based future API): signIn.create → resetPasswordEmailCode.sendCode/verifyCode/submitPassword → signIn.finalize({ navigate })
New env var NEXT_PUBLIC_CLERK_SIGN_IN_FORGOT_PASSWORD_URL=/forgot-password so the bundled <SignIn> widget's internal "Forgot password?" link routes here instead of Clerk's hosted page
Component test added at tests/forgot-password.test.tsx (vitest + @testing-library/react + happy-dom) covering both step renders, the create→sendCode→verifyCode→submitPassword→finalize chain, and Clerk error surfacing
docs: Google OAuth — document Clerk Dashboard setup requirement
.env.example now explains that social login providers (GitHub, Google, etc.) are enabled in the Clerk Dashboard under User & Authentication → Social Connections — not via env vars
Added NEXT_PUBLIC_CLERK_SIGN_IN_URL, NEXT_PUBLIC_CLERK_SIGN_UP_URL, NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL, NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL to .env.example so OAuth redirect behavior is predictable once Google is enabled
No code changes required: <SignIn> / <SignUp> components already render whatever providers are enabled in the Dashboard; the Google button will appear automatically after enabling it there
fix: userId attribution in /api/directory/submit (issue #1)
Agents submitted by logged-in users now correctly appear in the "My Sites" dashboard
Root cause: SiteConfig built in the isCreate branch of submit/route.ts never included userId, so sites.user_id was always NULL and the dashboard query returned zero rows
Fix: added ...(userId ? { userId } : {}) spread to the config object, matching the existing pattern in deploy/route.ts
Added two regression tests: authed submit asserts userId is present in the insert payload; anonymous submit asserts the key is absent entirely