chore: Update dependencies to latest

fix: claude fixes to various errors

docs/archive/handoffs/handoff-2026-03-15-auth-magic-link.md

@@ -0,0 +1,88 @@
+# Session Handoff: Auth Refactor — Magic Link & Cleanup
+**Date:** 2026-03-15
+**Session Duration:** ~1 hour
+**Session Focus:** Remove Google/Discord OAuth, add magic link login, add About dialog
+**Context Usage at Handoff:** ~30%
+
+## What Was Accomplished
+
+1. Analyzed full auth flow (store, boot, login page, router guard) → no output file, inline analysis
+2. Removed Google OAuth → deleted `src/components/GoogleOauthComponent.vue`
+3. Removed Discord OAuth → deleted `src/components/DiscordOauthComponent.vue`
+4. Removed `googleLogin`, `discordLogin` from auth store → `src/stores/auth.ts`
+5. Removed `OAuthProvider` import from auth store → `src/stores/auth.ts`
+6. Added `createMagicURLSession()` to auth store (calls `account.createMagicURLToken`) → `src/stores/auth.ts`
+7. Added `magicURLLogin()` to auth store (calls `account.updateMagicURLSession`) → `src/stores/auth.ts`
+8. Updated `LoginPage.vue` — removed OAuth component imports/usage, added "Send Magic Link" button, added `onMounted` handler to detect magic link callback params and call `magicURLLogin` → `src/pages/LoginPage.vue`
+9. Added "About" item to left drawer → `src/components/LeftDrawer.vue` — opens a Quasar Dialog with app name, version, description
+10. Converted `src/version.js` → `src/version.ts` to eliminate TS hint
+11. Updated `generate-version.js` to write to `src/version.ts` → `generate-version.js`
+12. Fixed stale import in `SignupPage.vue` (`src/version.js` → `src/version`) → `src/pages/SignupPage.vue`
+13. Fixed `LeftDrawer.vue` import path `boot/appwrite` → `src/boot/appwrite` (was a TS module resolution error)
+
+## Exact State of Work in Progress
+
+- `.env.local` not being picked up by `quasar dev`: user interrupted the fix (was about to add `require('dotenv').config(...)` to `quasar.config.js`). **Status: UNRESOLVED.** User stopped this change — may prefer a different approach or wants to investigate themselves.
+
+## Decisions Made This Session
+
+- Use `account.updateMagicURLSession(userId, secret)` (not `createSession`) for magic link completion — BECAUSE Appwrite SDK v14 uses a separate method for magic URL vs OTP token sessions. `createSession` is for OTP only.
+- Magic link callback URL = `window.location.origin + '/login'` — Appwrite appends `?userId=xxx&secret=xxx` and the `onMounted` handler in LoginPage detects and consumes these.
+- Keep OTP code flow alongside magic link — user did not ask to remove it; both are available.
+- About dialog placed in LeftDrawer (not a separate page) — appropriate pattern for simple info display in a mobile app.
+
+## Key Numbers Generated or Discovered This Session
+
+- Appwrite SDK version: `^14.0.1`
+- `@quasar/app-vite` version: `^1.9.1`
+- App version string source: `src/version.ts`, written by `generate-version.js` (takes version as CLI arg)
+- Dev server port: `4000` (set in `quasar.config.js` `devServer.strictport`)
+
+## Conditional Logic Established
+
+- IF magic link callback detected (`query.userId && query.secret` in route on LoginPage mount) THEN call `magicURLLogin(userId, secret)` BECAUSE this uses `updateMagicURLSession` which is the correct Appwrite v14 API.
+- IF user enters email and clicks "Send Code" THEN OTP flow runs (6-digit code emailed, entered in second input field).
+- IF user enters email and clicks "Send Magic Link" THEN magic link email sent; user clicks link; page reloads at `/login?userId=xxx&secret=xxx`; `onMounted` auto-completes login.
+
+## Files Created or Modified
+
+| File Path | Action | Description |
+|-----------|--------|-------------|
+| `src/stores/auth.ts` | Modified | Removed `googleLogin`, `discordLogin`, `OAuthProvider` import; added `createMagicURLSession`, `magicURLLogin` |
+| `src/pages/LoginPage.vue` | Modified | Removed OAuth components; added magic link button and `onMounted` callback handler |
+| `src/components/LeftDrawer.vue` | Modified | Added "About" menu item that opens info dialog with version; fixed boot import path |
+| `src/components/GoogleOauthComponent.vue` | Deleted | No longer used |
+| `src/components/DiscordOauthComponent.vue` | Deleted | No longer used |
+| `src/version.ts` | Renamed (was `.js`) | Eliminates TypeScript implicit-any hint |
+| `src/pages/SignupPage.vue` | Modified | Updated `version.js` import to `version` |
+| `generate-version.js` | Modified | Now writes to `src/version.ts` instead of `src/version.js` |
+
+## What the NEXT Session Should Do
+
+1. **First**: Verify magic link flow end-to-end in dev environment (send link, click it, confirm auto-login works)
+2. **Then**: Resolve `.env.local` not being picked up — options are: (a) add `require('dotenv').config({ path: '.env.local' })` to top of `quasar.config.js`, or (b) use `.env` instead of `.env.local`, or (c) investigate if `@quasar/app-vite` 1.9.x has a bug
+3. **Then**: Check if `SignupPage.vue` / `register()` flow is still intended — it creates email+password accounts but the login page only offers passwordless flows; this is an inconsistency
+
+## Open Questions Requiring User Input
+
+- [ ] Should the OTP (6-digit code) flow be kept, or replaced entirely by magic link? — impacts LoginPage UX
+- [ ] Should the SignupPage (email+password registration) be removed in favour of magic link only? — impacts `src/pages/SignupPage.vue`, `src/stores/auth.ts` `register()`, router `/signup` route
+- [ ] Should "Forgot Password?" link be removed from LoginPage now that magic link is the primary flow? — it was already removed from LoginPage in this session (not present in current code)
+- [ ] `.env.local` fix approach — user stopped the `dotenv` approach; confirm preferred method
+
+## Assumptions That Need Validation
+
+- ASSUMED: `window.location.origin` is correct for magic link callback URL in all deployment environments — validate that prod URL matches what Appwrite Console has whitelisted as a redirect domain
+- ASSUMED: Appwrite project has magic URL tokens enabled — validate in Appwrite Console → Auth settings
+
+## What NOT to Re-Read
+
+- `src/components/GoogleOauthComponent.vue` — deleted
+- `src/components/DiscordOauthComponent.vue` — deleted
+
+## Files to Load Next Session
+
+- `src/stores/auth.ts` — primary auth logic, fully refactored this session
+- `src/pages/LoginPage.vue` — magic link + OTP UI, modified this session
+- `src/boot/appwrite.ts` — contains duplicate `login()` function (email/password) that may be dead code post-refactor
+- `quasar.config.js` — if resolving `.env.local` issue