Give go-auth mail delivery on the shared platform/email sender (same
transport contract as the order service's ORDER_EMAIL_*): AUTH_EMAIL_SENDER=
smtp|log with the AUTH_EMAIL_SMTP_* knobs. /forgot emails a single-use
AOF-backed reset link (no enumeration, throttled) and /reset sets a new
password, revoking sessions, refresh tokens and remaining reset links;
admin invite + password-reset email credentials, and the create_user /
set_user_password MCP tools match (revoking outstanding reset links too).
Compose/k8s default to the log sender so the flows are exercisable without
SMTP credentials. Committed together with the Auth MCP server, its client-
registry admin UI, and the mcp-servers doc row they build on.
Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
