06-Feb-2026 — move forgot password flow to backend and fix credential modals ref: #157

build 469 — commit 3e9cb24

The forgot password feature was broken for users who were not logged in. This fix moves the password reset email process entirely to the server so it works reliably for all users regardless of login state.

Forgot password - new experience

• When opening "I've forgotten my password", users are now presented with two ways to verify their identity via radio buttons
• "I know my email address or username" (selected by default) — enter the email address or username from your original welcome email
• "I don't know my email or username" — enter your Ramblers membership number and home postcode instead, so you can still reset your password without remembering your login details
• After submitting, a confirmation message is shown and the form becomes read-only to prevent duplicate requests
• For security, the same message appears whether or not the details matched a member, so no one can use this form to discover who is or isn't a member
• Postcodes are accepted in any format — with or without spaces, upper or lower case. For example "tn263hf", "TN26 3HF", and "tn26 3hf" are all treated the same

Login and password reset - now more flexible

• All login and password-related dialogs now accept either your email address or username wherever you see an identity field — you no longer need to remember which one you registered with
• Fields are labelled "Email address or username" to make this clear

Login on mobile - autofill fix

• Previously, when your phone or browser auto-filled your saved username and password, the Login button could remain greyed out even though the fields appeared filled in
• This is now fixed — the Login button is always clickable and validates your credentials when you tap it

Modal dialog behaviour

• Login, forgot password, and reset password dialogs can now only be closed using the explicit buttons (Close, Cancel, Start Over etc.) — clicking outside the dialog or pressing Escape no longer dismisses them, preventing accidental loss of entered data
• All credential dialogs have consistent, compact button layout that displays correctly on both desktop and mobile without wrapping

Postcode normalisation

• The shared normalisePostcode function now correctly handles postcodes entered without spaces by stripping all whitespace, matching the UK postcode pattern, and re-inserting the standard space before the last 3 characters
• This benefits both the forgot password flow and the existing postcode lookup service

Technical changes

• New server-side endpoint handles member lookup, password reset ID generation, and Brevo transactional email sending in a single request
• Debug logging enabled on the forgot password endpoint for operational visibility
• Removed legacy client-side forgot password controller, auth route, and unused service methods
• Reset password modal template and empty stylesheet inlined into the component
• Disabled noisy aws-controllers debug logging