[argszero]

Summary

Fixes the dead-end when logging in with an unverified email: the API returns 403 邮箱未验证，请先输入验证码完成验证, but the login page only showed a toast — the user had no way to reach the verification code form.

The login submit catch now handles 403 (in addition to the existing 401 branch):

• prefills #verify-email with the attempted email
• switches to the existing verify form (showAuthForm("verify") — code input + resend button + submit were already implemented)
• auto-triggers the resend button click so the code is sent to the inbox immediately (60s rate limit falls back to the backend's 429 message)
• bumps the cache-busting version to 20260821-1

Related Issue

Host bug report rant 2026-08-21T12:31:48 (project: aitokenpool) — no GitHub issue number.

Changes

• ui/js/app.js: login catch gains a 403 branch → verify form + prefill + auto resend
• ui/index.html: cache-busting version v=20260820-5 → v=20260821-1

Tests

• cargo test — 132 passed; 0 failed
• cargo fmt --check — pass
• cargo clippy --all-targets — no new warnings
• node --check on all ui/js/*.js
• Targeted node simulation of the catch branch: 403 → verify form + prefill + resend; 401 → inline error only; 500 → toast only

Checklist

• Branch naming matches convention (fix/...)
• Conventional Commits message
• Single responsibility, minimal diff (2 files, +11/−5)