Build Real Web App Authentication with Sessions and Protected Routes

PROJECT CONTEXT:
A web app needs a complete working authentication system with real persistence, session handling, protected routes, and clear UI behavior.

GOAL:
Create real signup, login, session persistence, logout, password reset, and protected dashboard routes that work across refresh and properly handle errors.

REQUIREMENTS:
- Implement email and password signup with confirm password validation
- Implement login and logout with real authenticated user state
- Persist session across page refreshes
- Protect dashboard and authenticated-only routes
- Show validation, loading, and server error states in the UI
- Handle duplicate email signup attempts with a visible user-facing error
- Implement password reset flow
- Make auth screens mobile responsive
- Never store plaintext passwords
- Ensure logged-out users are redirected away from protected pages

CONSTRAINTS:
- Do not create visual-only forms without real backend or auth service integration
- Implement real persistence and user session state
- Include clear loading and error behavior for every auth action
- Never store plaintext passwords anywhere in the app
- Protected routes must be enforced in routing logic, not just hidden in navigation

DEFINITION OF DONE:
- A new user can sign up and a real user record is created in the chosen auth system or backend
- A valid user can log in and log out successfully
- Refreshing the browser keeps the user signed in until they log out or the session expires
- Unauthenticated users cannot access protected dashboard routes
- Submitting a duplicate email during signup shows a clear visible error message
- Validation errors for empty fields, invalid email, mismatched passwords, and weak passwords are visible in the UI
- Password reset can be requested and completes through a real flow
- Auth pages and dashboard entry points work on mobile screen sizes

COMMON FAILURES TO AVOID:
- Creating signup and login forms that do not connect to a real auth provider or backend
- Pretending session persistence exists while user state resets on refresh
- Allowing direct access to protected routes by URL when logged out
- Handling duplicate email or invalid credentials only in console logs instead of showing UI errors
- Storing tokens or passwords insecurely or exposing sensitive auth logic in the client
- Adding a reset password screen that is not connected to a real reset mechanism