Implements magic link logins

[rnambaale]

Description

Implements the magic link account setup page where users land after clicking a setup link from their email. The page validates the magic link token, then presents a form to set their initial account password.

Backend support: refactor-group/refactor-platform-rs#273

GitHub Issue: [Resolves] #350

Changes

• Added /setup/[token] route with token validation on page load and password setup form
• Added MagicLinkApi module with validate() and completeSetup() endpoints (unauthenticated, plain axios)
• Added AccountSetupForm component following existing password form patterns (min 8 chars, confirm match)
• Added SetupPageState discriminated union to manage page lifecycle (validating → ready → submitting → success / error)
• Remove initial password fields in add-member dialog (passwords now set via magic link)

Screenshots / Videos Showing UI Changes (if applicable)

Screenshots:

• Password form (ready state with user email displayed)

• Success state (checkmark + sign in link)

• Error state (invalid/expired token message)

Testing Strategy

1. Navigate to /setup/<valid-token> — should show spinner, then password form with user's email
2. Submit with mismatched or short passwords — client-side validation errors shown
3. Submit with valid passwords — POST to /magic-link/complete-setup, success screen with "Sign In" link
4. Navigate to /setup/<invalid-token> — should show error message after failed validation
5. Navigate to /setup/<expired-token> — should show "link expired" error
6. Navigate to /setup/<used-token> — should show "already set up" error

Concerns

• Backend endpoints (GET /magic-link/validate and POST /magic-link/complete-setup) must be implemented and deployed before this feature is functional (see Implements magic login links refactor-platform-rs#273)

[jhodapp]

@rnambaale This looks amazing, thank you!

Can we change it so that if a magic link times out, the message says to contact your coach instead of administrator?

Also I'm curious if we could display the status of the first-time-sign-in in the Members page for the user's coach. So when a coach adds a new member to their organization, the status for the user is pending. And if the magic link times out, the status for the user could be invitation expired and offer a button to the coach to resend the welcome email with a new magic link.

If this is too much to add to this PR, I'd be ok with a follow-on one as well with this PR being phase 1.