- The dialog now closes only when a session lands. Closing it from the
  password form too popped the route beneath when a reset link had been
  asked for first.
- A second reset request for the same address within a minute stays in
  the app: the Supabase client replaces the saved code verifier before
  the server refuses it, which broke the link already in the inbox.
- A sign-in link opened while someone is signed in is not exchanged. It
  would swap the session under the open library, possibly for another
  account, without the sign-out that keeps accounts apart. A toast says
  to sign out and ask for a new link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>