fix(auth): pass callbackPath through magic link sign-in flow

The callbackPath URL parameter was dropped when users chose the magic
link sign-in method. OAuth flows correctly threaded it via
getSignInCallbackUrl(params), but handleSendMagicLink only sent the
email. The backend already supported callbackUrl end-to-end — the only
gap was the frontend never sending it.

Author: RSO

src/hooks/useSignInFlow.ts

@@ -383,7 +383,8 @@ export function useSignInFlow({
     }
 
     try {
-      const result = await sendMagicLink(email);
+      const callbackUrl = getSignInCallbackUrl(params);
+      const result = await sendMagicLink(email, callbackUrl);
       if (result.success) {
         saveHint({
           lastEmail: email,
@@ -401,7 +402,7 @@ export function useSignInFlow({
       });
       setError('Failed to send magic link. Please try again.');
     }
-  }, [email, saveHint]);
+  }, [email, params, saveHint]);
 
   const handleTurnstileSuccess = useCallback(
     async (token: string) => {

src/lib/auth/send-magic-link.ts

@@ -7,14 +7,18 @@ export type SendMagicLinkResult = { success: true } | { success: false; error: s
  * Uses the Turnstile JWT cookie (from previous verification) for authentication.
  *
  * @param email - The email address to send the magic link to
+ * @param callbackUrl - Optional post-sign-in redirect URL (e.g. from getSignInCallbackUrl)
  * @returns Promise resolving to success/error result
  */
-export async function sendMagicLink(email: string): Promise<SendMagicLinkResult> {
+export async function sendMagicLink(
+  email: string,
+  callbackUrl?: string
+): Promise<SendMagicLinkResult> {
   try {
     const response = await fetch('/api/auth/magic-link', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email }),
+      body: JSON.stringify({ email, callbackUrl }),
     });
 
     const result = await response.json();