Signup lands here

After create, web signs in and opens this page. Native waits for the deep link.

A valid create signs in with the new password and opens /verify (or redirect_to after confirm). It does not skip email confirmation.

Forgot password is /forgot. Password reset is a different hashed row.