fix(auth): give Remember me a checkbox and stop it erasing the saved email

[MOHITKOURAV01]

What this fixes

Closes #1715

frontend/scripts/auth.js carries a complete "Remember me" implementation — saveRememberMe(), clearRememberMe(), loadRememberMe(), an element handle, and a branch in the login success path. The checkbox it all depends on, #remember-me, existed in no markup.

The result is worse than a missing feature. With elements.rememberMe permanently null, this branch takes the else arm on every successful login:

if (elements.rememberMe && elements.rememberMe.checked) {
    saveRememberMe(email);
} else {
    clearRememberMe();          // <-- unconditionally taken, every login
}

So rememberedEmail was erased on each sign-in, and the prefill in loadRememberMe() could never find anything to read back. saveRememberMe() was called from nowhere in the codebase — the feature looked implemented in review while doing nothing at runtime.

What changed

frontend/signin.html — adds the checkbox, sharing a row with the "Forgot Password?" link that previously sat alone in a right-aligned block. A wrapping <label for="remember-me"> makes the label text part of the hit target.

frontend/styles/auth.css — a .signin-options flex row and .remember-me control styling, including a dark-theme colour. The row keeps the link's existing right alignment and pushes the checkbox to the left, rather than restyling the link.

frontend/scripts/auth.js — the decision moves into applyRememberMePreference(email), which returns early when the control is absent:

function applyRememberMePreference(email) {
    if (!elements.rememberMe) {
        return;
    }

    if (elements.rememberMe.checked) {
        saveRememberMe(email);
    } else {
        clearRememberMe();
    }
}

Deliberate choices

• An absent control expresses no preference; only an unchecked one means "forget me". Collapsing those two cases is the entire bug. Keeping the guard means the same handler stays safe on any page that trims the form, instead of silently destroying a stored value it has no opinion about.
• Extracted rather than inlined. The three-way distinction (absent / checked / unchecked) is the part that was wrong, so it is now one named function with one job, testable on its own.
• No change to what is stored. Only the email is remembered, as before — no token, no password, nothing that would turn a convenience into a credential at rest.
• Reused the existing forgot-password link markup unchanged, so the change is additive to a row that already worked.

Tests

New backend/tests/rememberMe.test.js, 19 cases: the checkbox's presence, type and label, its placement inside the sign-in form (asserting it appears exactly once, so it cannot have landed in one of the three password-reset forms on the same page), the options-row layout and dark-mode styling, the early-return guard, and the full round trip — store on opt-in, prefill on return, checkbox reflecting stored state. One test pins that the old unconditional-clear shape does not come back.

Verified the guard is meaningful: with the frontend changes reverted and only the test applied, 13 of the 19 fail. With the fix in place all 19 pass.

Tests:       19 passed, 19 total

check-a11y-landmarks (31 page(s)) and check-assets (594 local reference(s) resolve) both pass.

Scope

One form row, one stylesheet block, one extracted function, one new test file. No backend, route or schema changes.

---

CI note

Syntax check is red on this branch, and on every open PR in the repo right now. The single failure is inherited from main:

❌ 1 of 653 JavaScript file(s) failed to parse:
  frontend/scripts/shop.js:2499
      Unexpected end of input

No file this PR touches is implicated — shop.js is untouched here. It is tracked as #1696 with a fix open in #1701. Because Syntax check gates the rest of the workflow, Backend tests and Server boots report skipping rather than running; both suites pass locally on this branch.

The red Vercel check is the repo-wide Authorization required to deploy (team bhuvanshs-projects) and is unrelated to this change.

[hydra-maintainer]

🔍 Quality Gate Report

✅ All quality gates passed!

Status	Check	Details
✅	Linked Issue	PR description references a closing issue ✅

[hydra-maintainer]

🤖 AI Code Review

🔴 Score: 50/100 | comment

AI review unavailable at this time.

---

Automated AI review — a human maintainer will also review.

[vercel]

@MOHITKOURAV01 is attempting to deploy a commit to the Bhuvansh's projects Team on Vercel.

A member of the Team first needs to authorize it.

[hydra-maintainer]

💡 Suggested reviewers based on relevant file history: @Aditya8369, @Pcmhacker-hero