fix: password reset email now redirects to update-password page

**Problem:**
Password reset emails redirected users to homepage with ?code= parameter,
leaving users stuck without ability to set new password.

**Root Cause:**
Auth callback route didn't detect password recovery flow. When Supabase
sent users back with type=recovery parameter, the callback defaulted to
/epd/clients redirect instead of /update-password.

**Solution:**
- Detect `type=recovery` parameter in auth callback route
- Always redirect password recovery flows to /update-password
- Preserves existing flows (signup, magic link) unchanged

**Flow now:**
1. User clicks reset link in email
2. Supabase verifies token → redirect to homepage with ?code=&type=recovery
3. Middleware redirects to /auth/callback?code=&type=recovery
4. Callback detects type=recovery → redirect to /update-password ✅
5. User can set new password

This fix ensures password reset works regardless of Supabase redirect_to
configuration, making the flow more resilient.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/auth/callback/route.ts

@@ -12,6 +12,7 @@ import type { NextRequest } from 'next/server'
 export async function GET(request: NextRequest) {
   const requestUrl = new URL(request.url)
   const code = requestUrl.searchParams.get('code')
+  const type = requestUrl.searchParams.get('type') // recovery, signup, etc
   const next = requestUrl.searchParams.get('next') ?? '/epd/clients'
 
   if (code) {
@@ -21,6 +22,11 @@ export async function GET(request: NextRequest) {
     const { data, error } = await supabase.auth.exchangeCodeForSession(code)
 
     if (!error && data.user) {
+      // Password recovery flow - always go to update-password
+      if (type === 'recovery') {
+        return NextResponse.redirect(new URL('/update-password', request.url))
+      }
+
       // Check if new user (first login)
       const isNewUser = new Date(data.user.created_at).getTime() ===
         new Date(data.user.last_sign_in_at || '').getTime()