Handle passwordless identities during sign-in

[AITechTim]

Summary

• Detect identities without a stored password hash before password verification so password sign-in no longer reaches an internal hash error.
• Return the same public INVALID_CREDENTIALS GraphQL error for passwordless identities as for unknown users or wrong passwords, avoiding account-state enumeration.
• Show generic invalid-credentials recovery guidance in the console, with a forgot-password link that keeps the attempted email prefilled.

Why

Invited accounts can exist without a local password hash, especially when they were created through invite or SSO-first flows. Password login for those accounts previously reached password verification with a nil hash and surfaced as an internal server error. This keeps the internal error typed while ensuring unauthenticated sign-in responses remain indistinguishable.

Validation

• npm ci
• PATH=/usr/local/go/bin:$PATH make @probo/emails
• PATH=/usr/local/go/bin:$PATH make relay
• PATH=/usr/local/go/bin:$PATH make generate
• /usr/local/go/bin/go test ./pkg/iam ./pkg/server/gqlutils ./pkg/server/api/connect/v1
• npm --workspace @probo/console run check
• ../../node_modules/.bin/eslint --no-warn-ignored src/pages/iam/auth/sign-in/PasswordSignInPage.tsx src/pages/iam/auth/ForgotPasswordPage.tsx
• git diff --check

Notes

The commit includes the required DCO Signed-off-by trailer and is GPG-signed with a GitHub-verified key. The account-state enumeration review thread is addressed by commit a6a7bdb.

[cubic-dev-ai]

1 issue found across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[lukkor]

Hello @AITechTim, we are looking into your PR internally and will come back to you soon, thanks for your contribution 🙏