fix(site): send portal sign-in codes and magic links via Cloudflare Email Sending

656d9e6 stubbed out sendCodingCatEmail to stop automated outreach, which
also silently stopped sign-in codes and magic links: Better Auth ignored the
false return, so /portal/[token] and /sign-in reported "code sent" while
nothing was sent.

Sign-in emails now go through the EMAIL binding (Cloudflare Email Sending,
codingcat.dev is onboarded) from noreply@codingcat.dev and throw on failure,
so the UI shows an error instead of a phantom success. Outreach email stays
disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: codercatdev

apps/site/src/lib/auth.ts

@@ -2,7 +2,7 @@ import { env } from "cloudflare:workers";
 import { mcp } from "@better-auth/mcp";
 import { betterAuth } from "better-auth";
 import { emailOTP, jwt, magicLink } from "better-auth/plugins";
-import { sendCodingCatEmail } from "@/lib/email";
+import { sendCodingCatAuthEmail } from "@/lib/email";
 
 export const BETTER_AUTH_SECRET =
 	(env as unknown as { BETTER_AUTH_SECRET?: string })?.BETTER_AUTH_SECRET ||
@@ -211,7 +211,7 @@ function buildPortalAuthPlugins() {
 					</div>
 				`;
 
-				await sendCodingCatEmail({
+				await sendCodingCatAuthEmail({
 					to: email,
 					subject,
 					text,
@@ -260,7 +260,7 @@ function buildPortalAuthPlugins() {
 					</div>
 				`;
 
-				await sendCodingCatEmail({
+				await sendCodingCatAuthEmail({
 					to: email,
 					subject,
 					text,

apps/site/src/lib/email.ts

@@ -424,6 +424,37 @@ export async function sendCodingCatEmailDetailed(
 	};
 }
 
+/**
+ * Sign-in codes and magic links are the one exception to the disabled
+ * automated sending above: nobody can sign in without them. They go through
+ * Cloudflare Email Sending, which requires `from` on the onboarded
+ * codingcat.dev domain.
+ */
+export async function sendCodingCatAuthEmail(opts: {
+	to: string;
+	subject: string;
+	text: string;
+	html: string;
+}): Promise<void> {
+	const workerEnv = (env ?? {}) as unknown as { EMAIL?: SendEmailBinding };
+	if (!workerEnv.EMAIL) {
+		throw new Error("EMAIL binding is not configured");
+	}
+	try {
+		await workerEnv.EMAIL.send({
+			to: opts.to,
+			from: { email: "noreply@codingcat.dev", name: "CodingCat.dev" },
+			subject: opts.subject,
+			text: opts.text,
+			html: opts.html,
+		});
+	} catch (error) {
+		const code = (error as { code?: string })?.code ?? "unknown";
+		console.error(`Sign-in email failed: ${code}`);
+		throw error;
+	}
+}
+
 export async function sendCodingCatEmail(
 	opts: CodingCatEmailOptions,
 ): Promise<boolean> {