feat(F-099): completed feature

work/artifacts/F-099/implementer.md

@@ -0,0 +1,15 @@
+# F-099 — Implementer evidence
+
+- Replaced the password-reset logging-only mailer with Nodemailer SMTP support.
+- Added protected SMTP configuration in admin Settings → SMTP / Email; password is never returned and blank password preserves the existing value.
+- Password reset reads SMTP settings from `store_settings` per send and returns a clear configuration error when incomplete.
+- Made frontend `:3003` the canonical customer app: reset request/confirm pages, account profile editing, authenticated password change, and same-origin user/address proxies are available there.
+- Set the LAN reset base URL to `http://192.168.18.93:3003`.
+- Fixed ISO date values for date inputs, generated description synchronization into Lexical/WYSIWYG, empty rich-text detection, admin log SSE cookie forwarding, and icon-only login/logout UI.
+
+Validation:
+- Root typecheck: exit 0
+- Frontend/admin typechecks: exit 0
+- Tests: 133 passed, 56 skipped
+- `scripts/verify.sh`: exit 0
+- Production services restarted and healthy on ports 3000, 3003, 3004, 3005

work/artifacts/F-099/leader-close.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-099",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-099 replaces the simulated reset mailer with configurable SMTP delivery and consolidates customer account controls.",
+  "evidence": [
+    "reviewer.json APPROVED",
+    "security.json APPROVED",
+    "qa.json APPROVED",
+    "verify.sh green"
+  ],
+  "timestamp": "2026-08-21T05:30:30Z"
+}

work/artifacts/F-099/qa.json

@@ -0,0 +1,12 @@
+{
+  "feature_id": "F-099",
+  "agent": "qa",
+  "verdict": "APPROVED",
+  "summary": "Backend typecheck and full test suite pass with the SMTP mailer and account changes in place.",
+  "evidence": [
+    "npm run typecheck exit 0",
+    "npm test: 133 passed, 56 skipped",
+    "scripts/verify.sh green"
+  ],
+  "timestamp": "2026-08-21T05:30:00Z"
+}

work/artifacts/F-099/reviewer.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-099",
+  "agent": "reviewer",
+  "verdict": "APPROVED",
+  "summary": "Password reset now delivers through configurable SMTP instead of logging to stdout; password change and account pages are consistent with the identity API.",
+  "evidence": [
+    "smtp-password-reset-mailer reads SMTP settings from store_settings with sane fallbacks to env vars",
+    "assertReady/isConfigured guard returns 422 EMAIL_DELIVERY_NOT_CONFIGURED instead of silently failing",
+    "PATCH /auth/me/password verifies current password before hashing the new one",
+    "Reset URL built from PUBLIC_APP_URL with trailing slash normalization"
+  ],
+  "timestamp": "2026-08-21T05:29:00Z"
+}

work/artifacts/F-099/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-099",
+  "agent": "security",
+  "verdict": "APPROVED",
+  "summary": "SMTP credentials stay server-side; reset tokens are single-use and only travel in the emailed link; no secrets leak in API responses.",
+  "evidence": [
+    "smtpPass is never returned by settings GET (smtpPassConfigured flag only)",
+    "Reset request keeps existing rate limiting and does not enumerate users",
+    "Session cookie remains httpOnly; new account routes reuse authenticate()",
+    "PUBLIC_APP_URL default is HTTPS"
+  ],
+  "timestamp": "2026-08-21T05:29:30Z"
+}