P0: fix(auth): preserve the request URI in recovery links

[aspiers]

Summary

Carry the active PAR request_uri into account recovery instead of using a placeholder. Successful recovery can then return the user to the authorization request that initiated sign-in.

Changes

• Render recovery links with the active request URI
• Thread the value through regular and preview render paths
• Cover the round trip with unit and Cucumber assertions

Testing

• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm test:coverage

Before/after evidence

Before: the recovery link used a placeholder request_uri. Clicking Back to sign in therefore could not return to the active authorization request or restore its OTP form.

After: the browser scenario now captures the live request_uri, follows the recovery link, clicks Back to sign in, verifies the same URI is restored, and asserts that a usable sign-in form is visible instead of an OAuth error. This is a navigation/state fix with no meaningful static visual difference; the complete behavioral round trip is covered in account-recovery.feature.

Notes

• The earlier PR-attached E2E attempt could not find the delayed deployment for the final amendment. After Railway recovered, the required check was rerun and the current SHA passed the full deployed suite in run 30561186061.

• Current-branch deployed E2E: run 30561478453.

• Focused extraction and review of work originally proposed in [WIP] many usability fixes (needs untangling) #165.

• The deployed E2E suite passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
epds-demo	Ready	Preview	Jul 30, 2026 4:23pm

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: edcaeb49-8806-4672-85e0-214e4365f99b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 79ca2e2

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[railway-app]

🚅 Deployed to the ePDS-pr-218 environment in ePDS

Service	Status	Web	Updated (UTC)
@certified-app/demo untrusted	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:55 pm
@certified-app/auth-service	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:55 pm
@certified-app/demo	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:54 pm
@certified-app/pds-core	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:54 pm

[coveralls-official]

Coverage Report for CI Build 30561185967

Coverage remained the same at 57.281%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3069
Covered Lines:	1753
Line Coverage:	57.12%
Relevant Branches:	1910
Covered Branches:	1099
Branch Coverage:	57.54%
Branches in Coverage %:	Yes
Coverage Strength:	6.06 hits per line

---

💛 - Coveralls

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud