Integrate email notifications into signup and login (#38)

docs/implementation.md

@@ -480,3 +480,39 @@ in [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), which remains unmerge
 - Task: <https://git.sendico.io/tech/sxchnge/issues/36>.
   PR: <https://git.sendico.io/tech/sxchnge/pulls/37>, branch `notifications-36`.
   Merge order: [#35](https://git.sendico.io/tech/sxchnge/pulls/35), then #37.
+
+## Signup and login notifications (#38)
+
+Task [#38](https://git.sendico.io/tech/sxchnge/issues/38), branch `auth-38`.
+Added signup/activation and login-code routes using the local customer,
+verification and session stores, with a TLS-authenticated adapter to the
+notifications interface module. English/Russian email templates and Flutter
+DTO/mapper/service adapters preserve provider/UI boundaries. Backend mode hides
+the preview shortcut and requires confirmed login for workspace navigation;
+unverified accounts go to email recovery.
+
+Review fixed real Mongo empty-target matching for cooldown/invalidation/replay,
+replaced predictable automatic verification keys with cryptographic randomness,
+removed token/hash/key previews from verification logging, bounded resend expiry
+by the pending JWT, preserved password whitespace and prevented consumed-code
+redelivery. Structured flow outcomes and latency metrics supplement existing
+journey instrumentation. Generated localization files are now ignored/untracked;
+`make test-frontend` regenerates them from ARB sources before tests.
+
+Validation passed: `make test` (Go race tests and all frontend suites),
+`make lint-backend`, `flutter analyze` in both `frontend/packages/sxchnge_auth`
+and `frontend/app`, and Dart format verification for all 17 changed hand-written
+Dart files. Tests include a real Mongo signup/activation/login journey, caller
+TLS authentication, unavailable delivery, invalid/single-use codes, immutable
+resend payloads, Flutter adapter/session mapping, unverified-account recovery,
+and backend-mode route gating. Initial failures in query-test OR support,
+localized-copy expectations and formatting were fixed and the checks rerun.
+No live email or optional security scan was run.
+
+See [configuration, contracts, UX evidence and recovery limits](auth-notifications.md).
+Queue acceptance is not inbox delivery. Product-side crashes before Send require
+user resend; initial signup/login retries are not exactly-once operations.
+Session response failures require restarting login. Session restore/refresh,
+production analytics export and wallet/settings backend adapters remain outside
+this contribution. Configure notification credentials/TLS/templates and the
+frontend API URL/public client before enabling real auth.