Passwordless sign-in page: email code, Google and Apple

CLAUDE.md

@@ -15,6 +15,8 @@ The web frontend is a Bangladesh-first budget and receipt tracking prototype. Th
 
 Connected mode uses the existing ScribbleScan API only through `/v1`. Response types are generated from `openapi.json` into `src/api/generated`; never edit generated files by hand. The Next.js rewrites in `next.config.ts` target `http://127.0.0.1:8000` by default and can be overridden with `SCRIBBLESCAN_API`.
 
+Sign-in (`app/connect/page.tsx`) is passwordless: **Continue with email** (a code, or the link in the email), **Google** and **Apple**, through `/v1/auth/*`. The page makes the PKCE verifier (`oidc.begin()`, kept in localStorage so the emailed link works in a new tab), the API runs the sign-in with Zitadel, and the browser lands on `/?code=...`, which the app shell hands to `/connect` for `oidc.finish()`. `GET /v1/config`'s `login_methods` says which choices work; empty with `auth: "oidc"` means Zitadel's hosted pages, and dev mode signs in from the email step without a code.
+
 The phone pairing secret belongs only in the scan URL fragment. QR SVGs must come from `POST /v1/qr`, never from a URL containing the secret.
 
 ## Commands

app/globals.css

@@ -106,6 +106,11 @@ select {
   outline-offset: 2px;
 }
 
+/* Headings get focus from code (so screen readers follow a step change), not from Tab. */
+[tabindex="-1"]:focus-visible {
+  outline: none;
+}
+
 ::selection {
   background: #285b4d;
   color: #fff;

biome.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
   "files": {
-    "includes": ["**", "!src/api/generated", "!dist", "!openapi.json"]
+    "includes": ["**", "!.next", "!src/api/generated", "!dist", "!openapi.json"]
   },
   "formatter": {
     "indentStyle": "space",