**Problem:**
Password reset emails redirected users to homepage with ?code= parameter,
leaving users stuck without ability to set new password.
**Root Cause:**
Auth callback route didn't detect password recovery flow. When Supabase
sent users back with type=recovery parameter, the callback defaulted to
/epd/clients redirect instead of /update-password.
**Solution:**
- Detect `type=recovery` parameter in auth callback route
- Always redirect password recovery flows to /update-password
- Preserves existing flows (signup, magic link) unchanged
**Flow now:**
1. User clicks reset link in email
2. Supabase verifies token → redirect to homepage with ?code=&type=recovery
3. Middleware redirects to /auth/callback?code=&type=recovery
4. Callback detects type=recovery → redirect to /update-password ✅
5. User can set new password
This fix ensures password reset works regardless of Supabase redirect_to
configuration, making the flow more resilient.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
1c305c7d1e