Owner sign-in
Owners use an email and a password. A new account stays on Verification in progress until the team approves it.
- The password is stored as a hash, not as the password you typed.
- Forgot password sends a code to that email. Repeated reset attempts are limited.
- The session is signed. The refresh cookie cannot be read by the page, and in production it is only sent over HTTPS.
