feat(auth): ManaAuthUI-Migration — vollständige Auth-Reise nativ

Phase 4a aus dem Native-Auth-Vollausbau-Plan.

- project.yml: ManaSwiftUI/ManaAuthUI als Package-Dep
- Sources/Core/Theme/CardsBrand.swift: Bridge zwischen CardsTheme
  (forest-HSL) und ManaBrandConfig — wird im RootView via
  .manaBrand(...) gesetzt
- Sources/App/RootView.swift: alte LoginView() durch ManaLoginView
  ersetzt, Sheets für SignUp/ForgotPassword/ResetPassword. Universal-
  Link-Handler erweitert um /auth/reset?token=… → ManaResetPasswordView
- Sources/Features/Account/LoginView.swift: gelöscht — komplett durch
  ManaLoginView aus ManaAuthUI abgedeckt
- Sources/Features/Account/AccountView.swift: Email-ändern + PW-ändern
  + Account-löschen Sheets (App-Store-Guideline 5.1.1(v) erfüllt)

BUILD SUCCEEDED gegen mana-swift-core@v1.1.0 und mana-swift-ui@v0.1.0.

Account-Sheets (Change/Delete) funktionieren erst nach Phase-3-
Server-PR (Bearer-Plugin in mana-auth) — UI ist fertig, Wire ist
fertig, Server zieht nach.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Sources/App/RootView.swift

@@ -1,3 +1,4 @@
+import ManaAuthUI
 import ManaCore
 import SwiftUI
 
@@ -8,6 +9,12 @@ struct RootView: View {
     @State private var selectedTab: AppTab = .decks
     @State private var pendingDeepLinkSlug: String?
     @State private var showCreateDeck = false
+    @State private var showSignUpSheet = false
+    @State private var showForgotSheet = false
+    @State private var resetPasswordToken: String?
+
+    private let sourceAppUrl = URL(string: "https://cardecky.mana.how/auth/verify")!
+    private let resetUniversalLink = URL(string: "https://cardecky.mana.how/auth/reset")!
 
     var body: some View {
         Group {
@@ -19,14 +26,55 @@ struct RootView: View {
                         if let url = activity.webpageURL { handle(url: url) }
                     }
             case .unknown, .signedOut, .signingIn, .error:
-                LoginView()
+                authSurface
+                    .onOpenURL { url in handle(url: url) }
+                    .onContinueUserActivity(NSUserActivityTypeBrowsingWeb) { activity in
+                        if let url = activity.webpageURL { handle(url: url) }
+                    }
             }
         }
+        .manaBrand(CardsBrand.manaBrand)
         .task {
             await auth.ensureSignedIn()
         }
     }
 
+    @ViewBuilder
+    private var authSurface: some View {
+        ManaLoginView(
+            auth: auth,
+            onSignUpTapped: { showSignUpSheet = true },
+            onForgotTapped: { showForgotSheet = true }
+        )
+        .sheet(isPresented: $showSignUpSheet) {
+            ManaSignUpView(
+                auth: auth,
+                sourceAppUrl: sourceAppUrl,
+                onDone: { showSignUpSheet = false }
+            )
+            .manaBrand(CardsBrand.manaBrand)
+        }
+        .sheet(isPresented: $showForgotSheet) {
+            ManaForgotPasswordView(
+                auth: auth,
+                resetUniversalLink: resetUniversalLink,
+                onDone: { showForgotSheet = false }
+            )
+            .manaBrand(CardsBrand.manaBrand)
+        }
+        .sheet(item: Binding(
+            get: { resetPasswordToken.map(IdentifiedString.init) },
+            set: { resetPasswordToken = $0?.value }
+        )) { token in
+            ManaResetPasswordView(
+                token: token.value,
+                auth: auth,
+                onDone: { resetPasswordToken = nil }
+            )
+            .manaBrand(CardsBrand.manaBrand)
+        }
+    }
+
     @ViewBuilder
     private var mainTabs: some View {
         TabView(selection: $selectedTab) {
@@ -51,19 +99,38 @@ struct RootView: View {
 
     /// Universal-Link- und URL-Scheme-Handler:
     /// - `https://cardecky.mana.how/d/<slug>` → Explore-Tab + PublicDeckView
+    /// - `https://cardecky.mana.how/auth/reset?token=…` → ManaResetPasswordView
     /// - `cards://study/<deckId>` → später (β-6 Notifications)
     private func handle(url: URL) {
         Log.app.info("Open URL: \(url.absoluteString, privacy: .public)")
-        if url.host == "cardecky.mana.how" || url.scheme == "cards" {
-            let parts = url.pathComponents.filter { $0 != "/" }
-            if parts.count >= 2, parts[0] == "d" {
-                pendingDeepLinkSlug = parts[1]
-                selectedTab = .explore
-            }
+        guard url.host == "cardecky.mana.how" || url.scheme == "cards" else { return }
+
+        let parts = url.pathComponents.filter { $0 != "/" }
+
+        // Auth-Reset-Link aus der Passwort-Vergessen-Email.
+        if parts == ["auth", "reset"],
+           let token = URLComponents(url: url, resolvingAgainstBaseURL: false)?
+               .queryItems?
+               .first(where: { $0.name == "token" })?.value
+        {
+            resetPasswordToken = token
+            return
+        }
+
+        if parts.count >= 2, parts[0] == "d" {
+            pendingDeepLinkSlug = parts[1]
+            selectedTab = .explore
         }
     }
 }
 
+/// Helper für `.sheet(item:)` mit einem String-Value (Reset-Token).
+private struct IdentifiedString: Identifiable {
+    let value: String
+    var id: String { value }
+}
+
+
 enum AppTab: Hashable {
     case decks
     case explore