- NextAuth session/jwt callbacks no longer return null (the client
useSession() hook chokes on a null session, crashing the app on
sign-out for deactivated/refreshed sessions) — fixes#57
- UserMenu/Header sign-out handlers close the Manage Users overlay and
popover before calling signOut(), and no longer let a rejected
signOut() promise go unhandled
- Added an app-level error boundary as a safety net for any remaining
client render errors
- Registration and forgot-password flows now tell the user honestly
when the confirmation/reset email failed to send instead of always
claiming success — related to #56
- lib/email.ts throws a clear, actionable error when neither
SMTP nor Resend is configured, instead of a cryptic SDK error
- Documented required SMTP/Resend env vars in DEPLOYMENT_CHECKLIST.md
(were missing entirely, which is why no confirmation/reset emails
were ever sent in deployed environments) — fixes#56
