magic_link_tokens table (user_id, token unique, expires_at, used_at). MagicLinkToken model with before_validation token generation (256-bit urlsafe_base64), valid scope (unused + not expired), consume!. MagicLinksController: new (email form), create (finds user, sends MagicLinkMailer#login via deliver_later, paranoid redirect regardless of email existence), show (validates + consumes token, signs user in via Devise sign_in, sets session[:magic_link_signed_in]), dismiss_suggestion (clears session flag, Turbo Stream removes banner). “Email me a sign-in link” added to login page below the sign-in form. Post-login _password_suggestion banner rendered from application layout while session flag is set; dismiss via DELETE /magic_link/suggestion removes it inline. 15 new tests (model + controller), full suite 466 green. Foundation for BL-070.
BL-069
Shipped