Problem: only a login page exists — no signup view (API-only), no forgot/reset pages, no links between them.
Scope: signup.stx (form POST /signup handler mirroring handleLogin: create user, set session cookie, redirect /dashboard), forgot.stx + reset.stx wired to existing /api/auth/forgot + /api/auth/reset, cross-links on all auth pages.
Done when: a stranger can land on /login, click through to create an account, and arrive at an empty project hub.