Encode sign-in mail as base64 so webmail cannot mangle the verify token.

Quoted-printable still rewrote token= as token=3D in the raw MIME, which some clients never decode. Distinguish a missing token from a real expiry, and keep links valid for 60 minutes.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/api/auth/magic-link/verify/route.ts

@@ -54,7 +54,15 @@ export async function GET(request: NextRequest) {
       where: { tokenHash },
     });
 
-    if (!row || row.expiresAt < new Date()) {
+    if (!row) {
+      return redirectWithRequestId(
+        request,
+        "/login?error=invalid_link",
+        requestId,
+      );
+    }
+
+    if (row.expiresAt < new Date()) {
       return redirectWithRequestId(
         request,
         "/login?error=expired_link",