added email

AGENTS.md

@@ -341,7 +341,7 @@ Body: { email }
 
 Step 2 — save new password
 POST  https://n8n.derez.ai/webhook/c2ce0eba-eb26-405d-8a90-8d982ec30698/update
-Body: { token, password }
+Body: { token, password, email }
 ```
 
 **Step 1** is triggered from `index.html` when the user clicks **Send reset email** inside `#reset-pw-wrap` (visible only after a failed sign-in). The response is intentionally ignored and the sent-confirmation is always shown — this avoids revealing whether the email address exists.

password.html

@@ -813,11 +813,12 @@
                 "https://n8n.derez.ai/webhook/c2ce0eba-eb26-405d-8a90-8d982ec30698/update";
             const APP_URL = "https://app.derez.ai";
 
-            /* ─── Extract token from URL ─────────────────────── */
+            /* ─── Extract token + email from URL ──────────────── */
             const params = new URLSearchParams(window.location.search);
             const token = params.get("token");
+            const email = params.get("email") || "";
 
-            /* ─── Init ───────────────────────────────────────── */
+            /* ─── Init ───────────────────────────────────── */
             if (!token || token.length < 8) {
                 document.getElementById("invalid-state").style.display = "flex";
             } else {
@@ -910,7 +911,7 @@
                     const res = await fetch(RESET_URL, {
                         method: "POST",
                         headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify({ token, password }),
+                        body: JSON.stringify({ token, password, email }),
                     });
 
                     if (!res.ok)