feat: real email OTP via SMTP, forgot password email, Settings on mobile nav

backend/app/api/auth.py

@@ -26,10 +26,12 @@ _otp_store: dict[str, dict] = {}
 @router.post("/send-otp")
 def send_otp(payload: dict, db: Session = Depends(get_db)):
     """
-    Generate and 'send' an OTP for email verification during signup.
-    In production, this would send an actual email. For demo purposes,
-    the OTP is returned in the response (and logged).
+    Generate and send an OTP for email verification during signup.
+    If SMTP is configured, sends a real email.
+    If not, returns OTP in response (demo mode).
     """
+    from app.services.email_service import send_otp_email, is_email_configured
+
     email = payload.get("email", "").strip().lower()
     username = payload.get("username", "")
     password = payload.get("password", "")
@@ -37,6 +39,10 @@ def send_otp(payload: dict, db: Session = Depends(get_db)):
     if not email:
         raise HTTPException(status_code=422, detail="Email is required.")
 
+    # Basic email format validation
+    if "@" not in email or "." not in email.split("@")[-1]:
+        raise HTTPException(status_code=400, detail="Invalid email address.")
+
     # Check if email already registered
     existing = db.query(User).filter(User.email == email).first()
     if existing:
@@ -53,12 +59,16 @@ def send_otp(payload: dict, db: Session = Depends(get_db)):
         "password": password,
     }
 
-    # In production: send email via SMTP/SendGrid/SES
-    # For demo: return OTP directly (would be removed in prod)
-    return {
-        "message": f"OTP sent to {email}",
-        "otp_preview": otp_code,  # Remove in production
-    }
+    # Try to send real email
+    email_sent = send_otp_email(email, otp_code)
+
+    response = {"message": f"Verification code sent to {email}"}
+
+    # Only show OTP preview if email sending is not configured (demo mode)
+    if not email_sent:
+        response["otp_preview"] = otp_code
+
+    return response
 
 
 @router.post("/verify-otp")
@@ -153,6 +163,8 @@ def forgot_password(
     email_data: ForgotPasswordRequest,
     db: Session = Depends(get_db),
 ):
+    from app.services.email_service import send_reset_email, is_email_configured
+
     user = db.query(User).filter(User.email == email_data.email).first()
 
     if not user:
@@ -161,7 +173,15 @@ def forgot_password(
     token = secrets.token_hex(16)
     _reset_tokens[token] = user.email
 
-    return {"reset_token": token}
+    # Send reset email if SMTP is configured
+    email_sent = send_reset_email(user.email, token)
+
+    response = {"message": "Password reset instructions sent to your email."}
+    if not email_sent:
+        # Demo mode: return token directly
+        response["reset_token"] = token
+
+    return response
 
 
 @router.post("/reset-password")

backend/app/services/email_service.py

@@ -0,0 +1,111 @@
+"""
+Email service for sending OTP verification codes.
+
+Uses SMTP (works with Gmail, SendGrid, Mailgun, etc.)
+Configure via environment variables:
+  SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM
+"""
+
+import os
+import smtplib
+import logging
+from email.mime.text import MIMEText
+from email.mime.multipart import MIMEMultipart
+
+logger = logging.getLogger(__name__)
+
+SMTP_HOST = os.environ.get("SMTP_HOST", "smtp.gmail.com")
+SMTP_PORT = int(os.environ.get("SMTP_PORT", "587"))
+SMTP_USER = os.environ.get("SMTP_USER", "")
+SMTP_PASS = os.environ.get("SMTP_PASS", "")
+SMTP_FROM = os.environ.get("SMTP_FROM", "") or SMTP_USER
+
+
+def is_email_configured() -> bool:
+    """Check if SMTP credentials are configured."""
+    return bool(SMTP_USER and SMTP_PASS)
+
+
+def send_otp_email(to_email: str, otp_code: str) -> bool:
+    """
+    Send OTP verification email.
+    Returns True if sent successfully, False otherwise.
+    """
+    if not is_email_configured():
+        logger.warning("SMTP not configured — OTP not sent (demo mode)")
+        return False
+
+    subject = "DocWeave — Your verification code"
+    html_body = f"""
+    <div style="font-family: -apple-system, sans-serif; max-width: 480px; margin: 0 auto; padding: 32px;">
+        <h2 style="color: #3b82f6; margin-bottom: 8px;">DocWeave</h2>
+        <p style="color: #666; margin-bottom: 24px;">Your email verification code is:</p>
+        <div style="background: #f3f4f6; border-radius: 8px; padding: 24px; text-align: center; margin-bottom: 24px;">
+            <span style="font-size: 32px; font-weight: 700; letter-spacing: 8px; color: #111;">{otp_code}</span>
+        </div>
+        <p style="color: #666; font-size: 14px;">This code expires in 10 minutes.</p>
+        <p style="color: #999; font-size: 12px; margin-top: 32px;">If you didn't request this, ignore this email.</p>
+    </div>
+    """
+
+    msg = MIMEMultipart("alternative")
+    msg["Subject"] = subject
+    msg["From"] = SMTP_FROM
+    msg["To"] = to_email
+    msg.attach(MIMEText(f"Your DocWeave verification code is: {otp_code}\n\nExpires in 10 minutes.", "plain"))
+    msg.attach(MIMEText(html_body, "html"))
+
+    try:
+        with smtplib.SMTP(SMTP_HOST, SMTP_PORT) as server:
+            server.starttls()
+            server.login(SMTP_USER, SMTP_PASS)
+            server.sendmail(SMTP_FROM, to_email, msg.as_string())
+        logger.info("OTP email sent to %s", to_email)
+        return True
+    except Exception as e:
+        logger.error("Failed to send OTP email to %s: %s", to_email, e)
+        return False
+
+
+def send_reset_email(to_email: str, reset_token: str) -> bool:
+    """
+    Send password reset email with a token link.
+    Returns True if sent successfully, False otherwise.
+    """
+    if not is_email_configured():
+        logger.warning("SMTP not configured — reset email not sent (demo mode)")
+        return False
+
+    # Use FRONTEND_URL env var for the reset link, fallback to localhost
+    frontend_url = os.environ.get("FRONTEND_URL", "http://localhost:5173")
+    reset_link = f"{frontend_url}/reset-password?token={reset_token}"
+
+    subject = "DocWeave — Reset your password"
+    html_body = f"""
+    <div style="font-family: -apple-system, sans-serif; max-width: 480px; margin: 0 auto; padding: 32px;">
+        <h2 style="color: #3b82f6; margin-bottom: 8px;">DocWeave</h2>
+        <p style="color: #666; margin-bottom: 24px;">You requested a password reset. Click the link below:</p>
+        <a href="{reset_link}" style="display: inline-block; background: #3b82f6; color: white; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 600;">
+            Reset Password
+        </a>
+        <p style="color: #999; font-size: 12px; margin-top: 32px;">This link expires in 1 hour. If you didn't request this, ignore this email.</p>
+    </div>
+    """
+
+    msg = MIMEMultipart("alternative")
+    msg["Subject"] = subject
+    msg["From"] = SMTP_FROM
+    msg["To"] = to_email
+    msg.attach(MIMEText(f"Reset your DocWeave password: {reset_link}", "plain"))
+    msg.attach(MIMEText(html_body, "html"))
+
+    try:
+        with smtplib.SMTP(SMTP_HOST, SMTP_PORT) as server:
+            server.starttls()
+            server.login(SMTP_USER, SMTP_PASS)
+            server.sendmail(SMTP_FROM, to_email, msg.as_string())
+        logger.info("Reset email sent to %s", to_email)
+        return True
+    except Exception as e:
+        logger.error("Failed to send reset email to %s: %s", to_email, e)
+        return False

frontend/src/components/layout/Sidebar.jsx

@@ -33,6 +33,7 @@ export function Sidebar() {
         { to: "/search", label: "Search", icon: "🔍" },
         { to: "/workflows", label: "Workflows", icon: "⚡", count: counts.workflows_waiting_for_review, countTone: "warning" },
         { to: "/activity", label: "Activity", icon: "📋" },
+        { to: "/settings", label: "Settings", icon: "⚙" },
     ];
 
     return (