feat: email-first login with allow-check and access forward

backend/app/auth/api.py

@@ -21,6 +21,8 @@ from .schemas import (
     AccessRequestRead,
     AdminBootstrapRequest,
     MagicConsumeRequest,
+    MagicRequestRead,
+    MagicRequestRequest,
     MeRead,
     MessageRead,
 )
@@ -120,6 +122,26 @@ def reject_request(
     return _read_request(request)
 
 
+@auth_router.post("/magic/request", response_model=MagicRequestRead)
+def request_magic(
+    data: MagicRequestRequest,
+    session: Session = Depends(get_db),
+):
+    """Email-first login: allowed emails get a magic link mailed.
+
+    403 means "not allowed" — the frontend forwards those to /access.
+    The token travels by mail only, never in the response.
+    """
+    try:
+        user, token = service.request_magic_link(session, data.email)
+    except service.ForbiddenError as exc:
+        raise HTTPException(status_code=403, detail=str(exc)) from exc
+    except service.RateLimitedError as exc:
+        raise HTTPException(status_code=429, detail=str(exc)) from exc
+    email_sent = mail.send_magic_link(user.email, mail.magic_link(token))
+    return MagicRequestRead(message="login link sent", email_sent=email_sent)
+
+
 @auth_router.post("/magic/consume", response_model=MeRead)
 def consume_magic(
     data: MagicConsumeRequest,