ackify

Reminder links resilient to email link prefetch

Email link scanners (Outlook SafeLinks, Proofpoint, Gmail preview, ...) prefetch URLs with GET requests. Because the reminder verification endpoint consumed its single-use token on GET, the token was often burned by a scanner before the recipient ever clicked ? leaving them unable to open and sign the document.

The reminder verification GET is now side-effect-free:

• OAuth deployments: the recipient is re-authenticated against the identity provider instead of a bearer session being minted from the link.
• MagicLink-only deployments: the recipient lands on a confirmation page whose explicit action POSTs back to consume the token.

The document id now travels through the reminder link, so recipients reach the right document even when the token has already expired or been consumed.

Case-insensitive email matching for acknowledgements (#28)

An expected signer added with one email casing (e.g. [email protected]) who acknowledged with another (e.g. [email protected]) was never matched: the signer stayed stuck in the "pending" state, and their acknowledgement was flagged as coming from an unexpected signer.

Signatures were already stored in lowercase, but expected-signer emails were stored verbatim and compared case-sensitively. Now:

• Expected-signer emails are normalized (trimmed + lowercased) on insert.
• Signer ? signature ? reminder matching is case-insensitive across status, statistics, "unexpected signer" detection, and reminder throttling.
• A migration lowercases existing expected_signers / reminder_logs rows and adds a case-insensitive uniqueness guarantee per document.

Existing documents are corrected on upgrade ? no manual action required.