Improve login UX for unconfirmed email + resend confirmation

- LoginForm: detect 403 separately, show amber warning with email address
- Add 'Resend confirmation email' button (calls POST /api/auth/resend-confirmation)
- Backend: POST /api/auth/resend-confirmation endpoint (generates new token, resends email)
- api.ts: add resendConfirmation method

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/auth.ts

@@ -225,6 +225,44 @@ const auth: FastifyPluginAsync = async (fastify) => {
     },
   )
 
+  // ── POST /api/auth/resend-confirmation ────────────────────────────────────
+  fastify.post<{ Body: { email: string } }>(
+    '/api/auth/resend-confirmation',
+    {
+      schema: {
+        body: {
+          type: 'object',
+          required: ['email'],
+          properties: { email: { type: 'string' } },
+        },
+      },
+    },
+    async (request, reply) => {
+      const { email } = request.body
+      const { rows } = await db.query(
+        `SELECT id, name FROM users WHERE email = $1 AND email_confirmed = false`,
+        [email.toLowerCase().trim()],
+      )
+      // Always return 200 to prevent enumeration
+      if (rows.length === 0) return reply.code(200).send({ ok: true })
+
+      const user = rows[0]
+      const confirmToken = crypto.randomBytes(32).toString('hex')
+      await db.query(
+        `UPDATE users SET confirmation_token = $1, confirmation_sent_at = NOW() WHERE id = $2`,
+        [confirmToken, user.id],
+      )
+
+      try {
+        await sendConfirmationEmail(email, user.name as string, confirmToken)
+      } catch (err) {
+        console.error('[email] Resend confirmation failed:', err)
+      }
+
+      return reply.code(200).send({ ok: true })
+    },
+  )
+
   // ── POST /api/auth/refresh ─────────────────────────────────────────────────
   fastify.post('/api/auth/refresh', async (request, reply) => {
     const refreshToken = request.cookies?.refresh_token

src/lib/api.ts

@@ -161,6 +161,9 @@ export const api = {
 
     resetPassword: (token: string, password: string) =>
       req<{ ok: boolean }>('POST', '/api/auth/reset-password', { token, password }),
+
+    resendConfirmation: (email: string) =>
+      req<{ ok: boolean }>('POST', '/api/auth/resend-confirmation', { email }),
   },
 
   // ── Rooms ─────────────────────────────────────────────────────────────────

src/pages/LoginPage.tsx

@@ -7,7 +7,7 @@ import {
 import { useAuth } from '../contexts/AuthContext'
 import { useTheme } from '../contexts/ThemeContext'
 import { cn } from '../lib/utils'
-import { api } from '../lib/api'
+import { api, ApiError } from '../lib/api'
 
 const DEMO_EMAILS = [
   'manager@grand-palace.ru',
@@ -51,11 +51,14 @@ function LoginForm({ onSwitch, onForgot }: { onSwitch: () => void; onForgot: ()
   const { login } = useAuth()
   const navigate  = useNavigate()
 
-  const [email,    setEmail]    = useState('')
+  const [email,              setEmail]              = useState('')
-  const [password, setPassword] = useState('')
+  const [password,           setPassword]           = useState('')
-  const [showPass, setShowPass] = useState(false)
+  const [showPass,           setShowPass]           = useState(false)
-  const [loading,  setLoading]  = useState(false)
+  const [loading,            setLoading]            = useState(false)
-  const [error,    setError]    = useState('')
+  const [error,              setError]              = useState('')
+  const [unconfirmedEmail,   setUnconfirmedEmail]   = useState<string | null>(null)
+  const [resendLoading,      setResendLoading]      = useState(false)
+  const [resendDone,         setResendDone]         = useState(false)
   const [searchParams] = useSearchParams()
   const confirmed    = searchParams.get('confirmed') === '1'
   const resetDone    = searchParams.get('reset') === 'success'
@@ -70,14 +73,29 @@ function LoginForm({ onSwitch, onForgot }: { onSwitch: () => void; onForgot: ()
       if (!loggedIn) { setError('Неверный email или пароль'); return }
       navigate('/calendar')
     } catch (err) {
-      const msg = err instanceof Error ? err.message : 'Ошибка соединения'
+      if (err instanceof ApiError && err.status === 403) {
-      // Strip "Ошибка сервера:" prefix for clean 403 messages from backend
+        setUnconfirmedEmail(email)
-      setError(msg)
+        setResendDone(false)
+      } else {
+        const msg = err instanceof Error ? err.message : 'Ошибка соединения'
+        setError(msg)
+      }
     } finally {
       setLoading(false)
     }
   }
 
+  const handleResend = async () => {
+    if (!unconfirmedEmail) return
+    setResendLoading(true)
+    try {
+      await api.auth.resendConfirmation(unconfirmedEmail)
+      setResendDone(true)
+    } catch { /* silent */ } finally {
+      setResendLoading(false)
+    }
+  }
+
   return (
     <>
       <h2 className="text-2xl font-bold text-slate-900 dark:text-slate-100 mb-1">
@@ -93,7 +111,7 @@ function LoginForm({ onSwitch, onForgot }: { onSwitch: () => void; onForgot: ()
           <input
             type="email" className="input" placeholder="email@example.com"
             value={email}
-            onChange={e => { setEmail(e.target.value); setError('') }}
+            onChange={e => { setEmail(e.target.value); setError(''); setUnconfirmedEmail(null) }}
             required
           />
         </div>
@@ -112,7 +130,7 @@ function LoginForm({ onSwitch, onForgot }: { onSwitch: () => void; onForgot: ()
             <input
               type={showPass ? 'text' : 'password'} className="input pr-10"
               placeholder="••••••••" value={password}
-              onChange={e => { setPassword(e.target.value); setError('') }}
+              onChange={e => { setPassword(e.target.value); setError(''); setUnconfirmedEmail(null) }}
               required
             />
             <button type="button" onClick={() => setShowPass(v => !v)}
@@ -128,6 +146,29 @@ function LoginForm({ onSwitch, onForgot }: { onSwitch: () => void; onForgot: ()
           </div>
         )}
 
+        {unconfirmedEmail && (
+          <div className="p-3 rounded-lg bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 text-sm">
+            <div className="flex items-start gap-2 text-amber-800 dark:text-amber-300 mb-2">
+              <AlertCircle size={15} className="shrink-0 mt-0.5" />
+              <span>Email <strong>{unconfirmedEmail}</strong> ещё не подтверждён. Проверьте почту и перейдите по ссылке из письма.</span>
+            </div>
+            {resendDone ? (
+              <div className="flex items-center gap-1.5 text-emerald-700 dark:text-emerald-400 text-xs">
+                <CheckCircle2 size={13} /> Письмо отправлено повторно
+              </div>
+            ) : (
+              <button
+                type="button"
+                onClick={handleResend}
+                disabled={resendLoading}
+                className="text-xs text-amber-700 dark:text-amber-400 hover:underline font-medium disabled:opacity-50"
+              >
+                {resendLoading ? 'Отправляем...' : 'Отправить письмо повторно'}
+              </button>
+            )}
+          </div>
+        )}
+
         {confirmed && (
           <div className="flex items-center gap-2 p-3 rounded-lg bg-emerald-50 dark:bg-emerald-900/20 text-emerald-700 dark:text-emerald-300 text-sm">
             <CheckCircle2 size={15} /> Email подтверждён! Теперь вы можете войти.