Preserve direct auth URL fallback

docs/verification.md

@@ -3399,3 +3399,16 @@ promoted.
   receive the alert channel; the monitor's unit tests cover state-transition,
   recovery, bounded metric parsing, and stale-backup alert behaviour without
   inducing a production outage.
+
+# 2026-08-21 authentication-email direct URL fallback
+
+- The HTML authentication message now contains one clickable action button and
+  one non-clickable, plain-text copy-and-paste URL. This prevents the fallback
+  itself from becoming a second provider-rewritten link.
+- The focused notifier test rendered the multipart message and passed all four
+  test cases. It also asserted that the HTML contains exactly one `href` and
+  that the direct application URL remains visible as text.
+- This does not prove that Brevo leaves the action button unchanged. The
+  provider tracking limitation remains open until a newly delivered production
+  message is inspected. No production or frozen test deployment was changed by
+  this local check.

lib/who_need_help/accounts/user_notifier.ex

@@ -182,7 +182,7 @@ defmodule WhoNeedHelp.Accounts.UserNotifier do
                   <td style="padding:20px 32px 8px;font-size:12px;line-height:1.5;color:#747a77;">#{escape_html(gettext("If the button does not work, copy and paste this address into your browser:"))}</td>
                 </tr>
                 <tr>
-                  <td style="padding:0 32px 28px;font-size:12px;line-height:1.5;word-break:break-all;"><a href="#{escaped_url}" style="color:#007d6b;">#{escaped_url}</a></td>
+                  <td style="padding:0 32px 28px;font-size:12px;line-height:1.5;word-break:break-all;color:#007d6b;">#{escaped_url}</td>
                 </tr>
               </table>
             </td>

test/who_need_help/accounts/user_notifier_test.exs

@@ -23,6 +23,8 @@ defmodule WhoNeedHelp.Accounts.UserNotifierTest do
     assert email.html_body =~ "<title>Sign in to Who Need Help</title>"
     assert email.html_body =~ ~s(href="#{url}")
     assert email.html_body =~ "copy and paste this address into your browser"
+    assert email.html_body =~ ~s(color:#007d6b;">#{url}</td>)
+    assert length(Regex.scan(~r/href=/, email.html_body)) == 1
     refute email.html_body =~ "<img"
     refute email.html_body =~ user.email
   end