Introduces src/lib/site-url.ts with getSiteUrl(), getSiteUrlFromRequest(),
and getSiteHostname() helpers that cascade through NEXT_PUBLIC_SITE_URL,
AUTH_URL, VERCEL_URL, and localhost so no code path ever falls back to a
third-party domain we may not own.
- forgot-password route now derives the base URL from the incoming request
origin so reset links always match the host the user hit
- email-sender, layout metadata, email preview, and QR code routes use the
new helper; email footers display the derived hostname instead of a
hardcoded brand string
- .env.example clarifies the real expected values for AUTH_URL and
NEXT_PUBLIC_SITE_URL per environment
Made-with: Cursor
- Replace bare inline HTML with a shared emailShell template system
- Use brand colors (warm neutrals), Quicksand font, and rounded card layout
- Add hidden preheader text for better inbox previews
- Proper table-based layout for email client compatibility (Outlook, Gmail, Apple Mail)
- Include Mso conditionals for Outlook button rendering
- Add dev-only email preview route at /api/dev/email-preview (gated behind NODE_ENV)
- Fix invitation email copy bug ("has invited you" / "You've been invited")
Made-with: Cursor
