Add comprehensive test coverage and update notes

tests/Feature/AuthControllerTest.php

@@ -94,6 +94,19 @@ it('sends a reset link for valid email', function (): void {
     $response->assertJsonStructure(['message']);
 });
 
+it('returns validation error when reset link cannot be sent', function (): void {
+    Password::shouldReceive('sendResetLink')
+        ->once()
+        ->andReturn(Password::INVALID_USER);
+
+    $response = $this->postJson('/api/forgot-password', [
+        'email' => 'missing@example.com',
+    ]);
+
+    $response->assertStatus(422);
+    $response->assertJsonValidationErrors(['email']);
+});
+
 it('resets a password with a valid token', function (): void {
     $user = User::factory()->create([
         'email' => 'reset2@example.com',
@@ -116,6 +129,22 @@ it('resets a password with a valid token', function (): void {
     expect(Hash::check('NewPassword123!', $user->password))->toBeTrue();
 });
 
+it('returns validation error when reset fails', function (): void {
+    Password::shouldReceive('reset')
+        ->once()
+        ->andReturn(Password::INVALID_TOKEN);
+
+    $response = $this->postJson('/api/reset-password', [
+        'email' => 'resetfail@example.com',
+        'password' => 'NewPassword123!',
+        'password_confirmation' => 'NewPassword123!',
+        'token' => 'bad-token',
+    ]);
+
+    $response->assertStatus(422);
+    $response->assertJsonValidationErrors(['email']);
+});
+
 it('verifies email and redirects to login', function (): void {
     $user = User::factory()->unverified()->create();
 
@@ -133,6 +162,19 @@ it('verifies email and redirects to login', function (): void {
     expect($user->hasVerifiedEmail())->toBeTrue();
 });
 
+it('rejects invalid email verification hash', function (): void {
+    $user = User::factory()->unverified()->create();
+
+    $url = URL::signedRoute('verification.verify', [
+        'id' => $user->id,
+        'hash' => sha1('wrong'),
+    ]);
+
+    $response = $this->get($url);
+
+    $response->assertStatus(403);
+});
+
 it('updates password for authenticated users', function (): void {
     $user = User::factory()->create([
         'password' => Hash::make('OldPass123!'),