diff --git a/.example.env b/.example.env
index dbdd07c..fd1feb5 100644
--- a/.example.env
+++ b/.example.env
@@ -2,11 +2,11 @@
 
 DATABASE_HOST=localhost
 DATABASE_PORT=5432
-DATABASE_NAME=codebloom
+DATABASE_NAME=patchats
 DATABASE_USER=postgres
 DATABASE_PASSWORD=enterpasswordhere
 # With the example values, this gets combined inside of the application.properties to make
-# jdbc://postgresql://localhost:5432/codebloom?user=postgres&password=enterpasswordhere
+# jdbc://postgresql://localhost:5432/patchats?user=postgres&password=enterpasswordhere
 
 # SMTP — consumed by spring.mail.* in non-dev profiles (the dev profile logs instead of sending)
 SMTP_HOST=smtp.example.com
@@ -16,3 +16,8 @@ SMTP_PASSWORD=enterpasswordhere
 # The verified From sender (a real, monitored mailbox on a domain you control)
 EMAIL_FROM=coffeechats@patinanetwork.org
 EMAIL_FROM_NAME=PatChats
+
+# Auth — public origin of the SPA; magic links point at $APP_BASE_URL/auth/verify?token=...
+APP_BASE_URL=http://localhost:5173
+# Set to false only when serving over plain HTTP (the dev profile already does this)
+AUTH_COOKIE_SECURE=true
diff --git a/Justfile b/Justfile
index b29dda3..754059b 100644
--- a/Justfile
+++ b/Justfile
@@ -12,6 +12,10 @@ drop *args:
 backend-dev *args:
   dotenvx run -f .env -- ./mvnw -Dspring-boot.run.profiles=dev spring-boot:run {{args}}
 
+# Run the backend Spring server with real SMTP delivery instead of the logging email sender
+backend-smtp *args:
+  dotenvx run -f .env -- ./mvnw -Dspring-boot.run.profiles=smtp spring-boot:run {{args}}
+
 # Run the backend Spring server with an exposed debugger at :5005
 backend-dev-debug *args:
   dotenvx run -- ./mvnw \
diff --git a/docs/auth-feature.md b/docs/auth-feature.md
index 5d664e2..58944a8 100644
--- a/docs/auth-feature.md
+++ b/docs/auth-feature.md
@@ -5,11 +5,9 @@ email, receives a single-use link, and clicking it establishes a server-side ses
 httpOnly cookie.
 
 **Form-first membership.** The sign-up form is the only way a member row is created; magic links
-purely sign in **existing** members. Requesting a link never reveals whether an account exists — the
-response is always the same generic 200, but for unregistered emails the backend silently sends
-nothing (logged at info level). Wiring the sign-up form submission to a real create-member endpoint
-is a separate ticket; until it lands, a login-capable member can only be created with a manual DB
-insert (see the walkthrough below).
+purely sign in **existing** members. Requesting a link for an email with no member row therefore
+**fails with 404**, and the login page turns that into a dead-end panel offering the two ways
+forward: try another address, or go sign up.
 
 ## The shape
 
@@ -20,10 +18,10 @@ src/main/java/org/patinanetwork/patchats/auth/
   TokenGenerator.java            SecureRandom 256-bit raw token + SHA-256 hex digest
   MagicLinkEmailComposer.java    builds the sign-in email via the EmailSender PORT
   RequestLinkRateLimiter.java    Bucket4j: 3/email + 10/IP per 15 min, in-memory buckets
+  MagicLinkTokenCleanup.java     @Scheduled sweep of expired token rows
   AuthProperties.java            @ConfigurationProperties("app.auth") → base-url, cookie-secure, magic-link-ttl
   repo/
-    MagicLinkTokenRepository.java  JdbcClient; atomic UPDATE..RETURNING consume
-    MemberAccountRepository.java   auth's read-only view of members (findByEmail, findById)
+    MagicLinkTokenRepo.java        JdbcClient; atomic UPDATE..RETURNING consume
   security/
     SecurityConfig.java            filter chains, cookie serializer, CSRF rationale (read its javadoc)
     AuthenticatedMember.java       Serializable session principal (memberId + email)
@@ -40,12 +38,15 @@ js/src/features/auth/
 1. `POST /api/auth/request-link {email}` — normalizes the email, then rate-limits **visibly**: an
    exhausted budget (3/email + 10/IP per 15 min) returns HTTP 429 with a friendly message, for
    **all** emails alike — the limiter runs before the member-existence check, so the 429 is
-   registration-blind and legitimate users know to stop retrying. Unregistered emails are skipped
-   *silently* (same generic 200 as a real send); that silence is the enumeration guard. For a
-   registered member it deletes outstanding tokens for that email, stores a **SHA-256 digest** of a
+   registration-blind and legitimate users know to stop retrying. Keep that ordering: it is also
+   what throttles probing. An email with no member row
+   then fails with HTTP 404 (`UnregisteredEmailException`). For a
+   registered member it stores a **SHA-256 digest** of a
    fresh 256-bit token (raw is never persisted), and emails
    `<app.auth.base-url>/auth/verify?token=<raw>`. Links expire after 15 minutes
-   (`app.auth.magic-link-ttl`).
+   (`app.auth.magic-link-ttl`). Issuing a link **does not** invalidate earlier ones — a member who
+   asks for a second link and then clicks the first email still gets in. Every link stands on its own
+   until it is used or expires, and the rate limiter is what bounds how many can be outstanding.
 2. The link lands on the **frontend** verify page, which POSTs the token. Email scanners only
    prefetch GETs, so they cannot burn the single-use token.
 3. `POST /api/auth/verify {token}` — consumes the token atomically
@@ -56,6 +57,10 @@ js/src/features/auth/
    (httpOnly, SameSite=Lax, Secure outside dev, 30-day Max-Age).
 4. Sessions expire after 30 days of inactivity (`spring.session.timeout`, sliding) and are purged by
    Spring Session's built-in cleanup job. `POST /api/auth/logout` invalidates the session row.
+   Magic-link rows get the same treatment from `MagicLinkTokenCleanup`, a `@Scheduled` sweep that
+   deletes anything past `expires_at` every `app.auth.token-cleanup-interval` — nothing else ever
+   deletes them, which is also why the table needs no index beyond the `token_hash` unique
+   constraint that `verify` looks up on.
 
 `GET /api/session` returns the member **fresh from the database** (never stale session state):
 `{ id, name, email, isAdmin }`; 401 in the envelope when signed out. The frontend `RequireAuth`
@@ -77,30 +82,34 @@ just dev       # backend :8080 (dev profile) + frontend :5173
 1. Create a test member (only needed until the sign-up form is wired to the backend):
    ```bash
    psql -h localhost -U postgres -d patchats -c \
-     "INSERT INTO members (id, email, full_name, introduction, active) \
-      VALUES (gen_random_uuid(), 'you@example.com', 'You', 'Testing locally', TRUE);"
+     "INSERT INTO members (id, first_name, last_name, email, introduction, active) \
+      VALUES (gen_random_uuid(), 'You', 'Tester', 'you@example.com', 'Testing locally', TRUE);"
    ```
-2. Open `http://localhost:5173/login`, submit that email. (An **unregistered** email shows the same
-   generic panel, but the backend log shows no email composed — just the info-level skip.)
+2. Open `http://localhost:5173/login`, submit that email. (An **unregistered** email instead gets a
+   404 and the "No account for that email" panel, with a link to `/sign-up`; the backend log shows
+   no email composed.)
 3. The dev profile does not send real email — `LoggingEmailSender` prints the full body to the
    **backend terminal**. Copy the `http://localhost:5173/auth/verify?token=...` URL from the log.
 4. Open it: you land on `/`. Check DevTools → Application → Cookies for `patchats_session`
    (httpOnly, Lax, not Secure in dev).
-5. Open the same link again → "invalid or expired" (single-use). Requesting a second link
-   invalidates the first. A 4th rapid request for the same email → the login page shows the 429
-   message ("too many sign-in requests"), whether or not the email is registered.
+5. Open the same link again → "invalid or expired" (single-use). Request a **second** link before
+   using the first, then open the first: it still signs you in — outstanding links are not
+   invalidated by a new one. A 4th rapid request for the same email → the login page shows the 429
+   message ("too many sign-in requests"), whether or not the email is registered — an unregistered
+   address hits the 429 before the 404, which is the ordering that keeps probing throttled.
 6. Log out from the header (visible on guarded pages like `/sample`); guarded routes now redirect
    to `/login`.
 
 ## Configuration
 
-| Property                 | Env var              | Default                 | Meaning                                  |
-| ------------------------ | -------------------- | ----------------------- | ---------------------------------------- |
-| `app.auth.base-url`      | `APP_BASE_URL`       | `http://localhost:5173` | Public SPA origin used in emailed links  |
-| `app.auth.cookie-secure` | `AUTH_COOKIE_SECURE` | `true` (`false` in dev) | `Secure` flag on the session cookie      |
-| `app.auth.magic-link-ttl`| —                    | `15m`                   | Link validity window                     |
-| `spring.session.timeout` | —                    | `30d`                   | Session inactivity timeout               |
+| Property                  | Env var              | Default                 | Meaning                                 |
+| ------------------------- | -------------------- | ----------------------- | --------------------------------------- |
+| `app.auth.base-url`       | `APP_BASE_URL`       | `http://localhost:5173` | Public SPA origin used in emailed links |
+| `app.auth.cookie-secure`  | `AUTH_COOKIE_SECURE` | `true` (`false` in dev) | `Secure` flag on the session cookie     |
+| `app.auth.magic-link-ttl` | —                    | `15m`                   | Link validity window                    |
+| `app.auth.token-cleanup-interval` | —            | `1h`                    | How often expired token rows are swept  |
+| `spring.session.timeout`  | —                    | `30d`                   | Session inactivity timeout              |
 
-Schema lives in Flyway (`db/migration/V0005`–`V0006`); `spring.session.jdbc.initialize-schema` is
+Schema lives in Flyway (`db/migration/V0006`–`V0007`); `spring.session.jdbc.initialize-schema` is
 `never` so the app never races migrations, and runtime Flyway is disabled (migrations stay
 out-of-band via `just migrate`).
diff --git a/js/src/features/auth/Login.page.test.tsx b/js/src/features/auth/Login.page.test.tsx
index eacbd55..cbb29a9 100644
--- a/js/src/features/auth/Login.page.test.tsx
+++ b/js/src/features/auth/Login.page.test.tsx
@@ -1,4 +1,7 @@
-import { rateLimitedResponse } from "@/features/auth/api/auth.mock";
+import {
+  rateLimitedResponse,
+  unregisteredEmailResponse,
+} from "@/features/auth/api/auth.mock";
 import LoginPage from "@/features/auth/Login.page";
 import { renderWithProviders, screen } from "@/lib/test/render";
 import { server } from "@/lib/test/server";
@@ -20,6 +23,35 @@ test("rejects an invalid email without calling the API", async () => {
   ).toBeInTheDocument();
 });
 
+test("offers sign-up and a retry when the email has no account", async () => {
+  server.use(
+    http.post("/api/auth/request-link", () => unregisteredEmailResponse()),
+  );
+  const user = userEvent.setup();
+  renderWithProviders(<LoginPage />);
+
+  await user.type(screen.getByLabelText(/email/i), "stranger@example.com");
+  await user.click(
+    screen.getByRole("button", { name: /email me a sign-in link/i }),
+  );
+
+  expect(
+    await screen.findByText("No account for that email"),
+  ).toBeInTheDocument();
+  expect(screen.getByText("stranger@example.com")).toBeInTheDocument();
+  expect(
+    screen.getByRole("link", { name: /complete the sign-up form/i }),
+  ).toHaveAttribute("href", "/sign-up");
+
+  await user.click(
+    screen.getByRole("button", { name: /try a different email/i }),
+  );
+
+  expect(await screen.findByLabelText(/email/i)).toHaveValue(
+    "stranger@example.com",
+  );
+});
+
 test("shows the generic check-your-email panel after submitting", async () => {
   const user = userEvent.setup();
   renderWithProviders(<LoginPage />);
diff --git a/js/src/features/auth/Login.page.tsx b/js/src/features/auth/Login.page.tsx
index e25e29b..d4224d6 100644
--- a/js/src/features/auth/Login.page.tsx
+++ b/js/src/features/auth/Login.page.tsx
@@ -16,9 +16,10 @@ import { zodResolver } from "mantine-form-zod-resolver";
 import { Link } from "react-router-dom";
 
 /**
- * Passwordless login: ask for an email, request a magic link, and show the
- * same "check your email" panel no matter what — account existence is never
- * revealed here.
+ * Passwordless login: ask for an email and request a magic link. Three states —
+ * the form, "check your email" once a link is on its way, and a dead end for an
+ * address with no account, which offers the only two ways forward (another
+ * address, or sign up).
  */
 export default function LoginPage() {
   const requestLink = useRequestLink();
@@ -28,10 +29,17 @@ export default function LoginPage() {
     validate: zodResolver(loginSchema),
   });
 
+  const submittedEmail = form.getValues().email.trim();
+
   const handleSubmit = form.onSubmit((values) => {
     requestLink.mutate(values.email.trim());
   });
 
+  /** The backend 404s an email with no member row; every other failure falls
+   * through to the alert inside the form. */
+  const isUnregistered =
+    requestLink.error instanceof ApiError && requestLink.error.status === 404;
+
   if (requestLink.isSuccess) {
     return (
       <Stack gap="md">
@@ -39,7 +47,7 @@ export default function LoginPage() {
         <Text>
           If you entered a valid address, a sign-in link is on its way to{" "}
           <Text component="span" fw={700}>
-            {form.getValues().email.trim()}
+            {submittedEmail}
           </Text>
           . The link expires in 15 minutes and can only be used once.
         </Text>
@@ -60,6 +68,31 @@ export default function LoginPage() {
     );
   }
 
+  if (isUnregistered) {
+    return (
+      <Stack gap="md">
+        <Title order={2}>No account for that email</Title>
+        <Text>
+          We couldn&apos;t find a PatChats account for{" "}
+          <Text component="span" fw={700}>
+            {submittedEmail}
+          </Text>
+          . Sign-in links are only sent to registered members.
+        </Text>
+        <Button onClick={() => requestLink.reset()}>
+          Try a different email
+        </Button>
+        <Text c="dimmed" size="sm">
+          Never signed up?{" "}
+          <Anchor component={Link} to="/sign-up" inherit>
+            Complete the sign-up form
+          </Anchor>{" "}
+          to join.
+        </Text>
+      </Stack>
+    );
+  }
+
   return (
     <Paper p="lg" withBorder>
       <form onSubmit={handleSubmit} noValidate>
diff --git a/js/src/features/auth/api/auth.mock.ts b/js/src/features/auth/api/auth.mock.ts
index 11bea50..7c5e33f 100644
--- a/js/src/features/auth/api/auth.mock.ts
+++ b/js/src/features/auth/api/auth.mock.ts
@@ -3,7 +3,7 @@ import { http, HttpResponse } from "msw";
 
 /**
  * MSW handlers for the auth domain, envelope-shaped like the real backend.
- * Defaults: request-link succeeds generically, verify signs in a member, and
+ * Defaults: request-link succeeds, verify signs in a member, and
  * there is no session (401). Tests override per case with `server.use(...)`
  * and the exported fixtures.
  */
@@ -25,6 +25,15 @@ export const invalidLinkResponse = () =>
     { status: 400 },
   );
 
+export const unregisteredEmailResponse = () =>
+  HttpResponse.json(
+    {
+      success: false,
+      message: "We couldn't find an account for that email.",
+    },
+    { status: 404 },
+  );
+
 export const rateLimitedResponse = () =>
   HttpResponse.json(
     {
diff --git a/pom.xml b/pom.xml
index 4d23ebe..91ec697 100644
--- a/pom.xml
+++ b/pom.xml
@@ -199,6 +199,19 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-jdbc</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.session</groupId>
+            <artifactId>spring-session-jdbc</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
         <!-- <dependency>
             <groupId>io.github.resilience4j</groupId>
             <artifactId>resilience4j-spring-boot3</artifactId>
diff --git a/src/main/java/org/patinanetwork/patchats/PatChatsApplication.java b/src/main/java/org/patinanetwork/patchats/PatChatsApplication.java
index 73f6307..ed5b19c 100644
--- a/src/main/java/org/patinanetwork/patchats/PatChatsApplication.java
+++ b/src/main/java/org/patinanetwork/patchats/PatChatsApplication.java
@@ -4,9 +4,11 @@
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.scheduling.annotation.EnableAsync;
+import org.springframework.scheduling.annotation.EnableScheduling;
 
 @SpringBootApplication
 @EnableAsync
+@EnableScheduling
 @Slf4j
 public class PatChatsApplication {
 
diff --git a/src/main/java/org/patinanetwork/patchats/auth/AuthController.java b/src/main/java/org/patinanetwork/patchats/auth/AuthController.java
index 04b5c96..f7bd39a 100644
--- a/src/main/java/org/patinanetwork/patchats/auth/AuthController.java
+++ b/src/main/java/org/patinanetwork/patchats/auth/AuthController.java
@@ -40,7 +40,7 @@
 @RequiredArgsConstructor
 public class AuthController {
 
-    /** The response is identical whether or not the email has an account, so nothing can be enumerated. */
+    /** Success copy for a link that was actually sent; an unregistered email fails with 404 instead. */
     private static final String GENERIC_REQUEST_MESSAGE = "Check your email for a sign-in link.";
 
     private final AuthService authService;
diff --git a/src/main/java/org/patinanetwork/patchats/auth/AuthProperties.java b/src/main/java/org/patinanetwork/patchats/auth/AuthProperties.java
index 64f774e..24bf20d 100644
--- a/src/main/java/org/patinanetwork/patchats/auth/AuthProperties.java
+++ b/src/main/java/org/patinanetwork/patchats/auth/AuthProperties.java
@@ -19,4 +19,11 @@ public class AuthProperties {
 
     /** How long an emailed magic link stays valid. */
     private Duration magicLinkTtl = Duration.ofMinutes(15);
+
+    /**
+     * How often expired magic-link rows are swept from the database. Declared here so the key is documented and shows
+     * up in config metadata; {@link MagicLinkTokenCleanup} resolves it as a {@code @Scheduled} placeholder, which
+     * cannot read a bound bean.
+     */
+    private Duration tokenCleanupInterval = Duration.ofHours(1);
 }
diff --git a/src/main/java/org/patinanetwork/patchats/auth/AuthService.java b/src/main/java/org/patinanetwork/patchats/auth/AuthService.java
index fbb5f3c..1ab2781 100644
--- a/src/main/java/org/patinanetwork/patchats/auth/AuthService.java
+++ b/src/main/java/org/patinanetwork/patchats/auth/AuthService.java
@@ -1,27 +1,26 @@
 package org.patinanetwork.patchats.auth;
 
 import java.time.Clock;
-import java.util.Locale;
-import java.util.UUID;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.patinanetwork.patchats.api.member.db.models.Member;
 import org.patinanetwork.patchats.api.member.db.repos.MemberRepo;
 import org.patinanetwork.patchats.auth.TokenGenerator.GeneratedToken;
-import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepository;
+import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepo;
+import org.patinanetwork.patchats.utilities.EmailNormalizer;
 import org.springframework.stereotype.Service;
 
 /**
  * Orchestrates the magic-link flow: issuing links (request) and exchanging them for a member (verify). Magic links only
- * sign in existing members — the sign-up form is the sole creator of member rows — and requesting a link never leaks
- * whether an account exists.
+ * sign in existing members — the sign-up form is the sole creator of member rows — so requesting a link for an
+ * unregistered email is an error (404), not a silent no-op.
  */
 @Service
 @RequiredArgsConstructor
 @Slf4j
 public class AuthService {
 
-    private final MagicLinkTokenRepository tokens;
+    private final MagicLinkTokenRepo tokens;
     private final MemberRepo members;
     private final TokenGenerator tokenGenerator;
     private final MagicLinkEmailComposer emailComposer;
@@ -30,27 +29,31 @@ public class AuthService {
     private final Clock clock;
 
     /**
-     * Issues a fresh single-use link and invalidates any outstanding ones for the email. Being rate-limited surfaces as
-     * a visible 429 — the limiter runs <em>before</em> the member-existence check, so the 429 is registration-blind and
-     * reveals nothing. Unregistered emails are skipped silently (the same generic success as a real send), so account
-     * existence stays unobservable.
+     * Issues a fresh single-use link. Previously issued links are deliberately left alone — each stays valid until it
+     * is used or expires, so a member who asks for a second link and then clicks the first email is not sent to a dead
+     * end. How many can be outstanding at once is bounded by the rate limiter, not by invalidation. An unregistered
+     * email is rejected outright so the login page can point the visitor at the sign-up form instead of leaving them
+     * waiting on an email that will never arrive.
+     *
+     * <p>The limiter runs <em>before</em> the member-existence check, deliberately: a 429 therefore says nothing about
+     * whether the address has an account, and it is the throttle that keeps the 404 from being a cheap way to farm
+     * membership. Keep that ordering.
      *
      * @throws TooManyLinkRequestsException when the per-email or per-IP budget is exhausted
+     * @throws UnregisteredEmailException when no member row exists for the email
      */
     public void requestLink(final String rawEmail, final String clientIp) {
-        final String email = normalize(rawEmail);
+        final String email = EmailNormalizer.normalize(rawEmail);
         if (!rateLimiter.tryAcquire(email, clientIp)) {
             log.warn("Rate-limited magic-link request for {} from {}", email, clientIp);
             throw new TooManyLinkRequestsException();
         }
         if (members.getMemberByEmail(email).isEmpty()) {
-            log.info("Skipping magic-link request for unregistered email {}", email);
-            return;
+            log.debug("Rejecting magic-link request for unregistered email {}", email);
+            throw new UnregisteredEmailException();
         }
         final GeneratedToken token = tokenGenerator.generate();
-        tokens.deleteByEmail(email);
-        tokens.insertToken(
-                UUID.randomUUID(), email, token.hash(), clock.instant().plus(properties.getMagicLinkTtl()));
+        tokens.insertToken(email, token.hash(), clock.instant().plus(properties.getMagicLinkTtl()));
         emailComposer.send(email, token.raw());
     }
 
@@ -65,12 +68,4 @@ public Member verify(final String rawToken) {
                 .orElseThrow(InvalidMagicLinkException::new);
         return members.getMemberByEmail(email).orElseThrow(InvalidMagicLinkException::new);
     }
-
-    /**
-     * Lowercases and trims before any lookup or token write. {@code MemberRepo.getMemberByEmail} matches the column
-     * exactly, so this is the single place email casing is reconciled — every path through this service must use it.
-     */
-    private static String normalize(final String email) {
-        return email.trim().toLowerCase(Locale.ROOT);
-    }
 }
diff --git a/src/main/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanup.java b/src/main/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanup.java
new file mode 100644
index 0000000..dbb1959
--- /dev/null
+++ b/src/main/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanup.java
@@ -0,0 +1,40 @@
+package org.patinanetwork.patchats.auth;
+
+import java.time.Clock;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepo;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+
+/**
+ * Sweeps expired magic-link rows, the counterpart to Spring Session's built-in cleanup of {@code spring_session}.
+ * Issuing a link never deletes anything, so without this the table would grow forever.
+ *
+ * <p>Unguarded by any distributed lock: the deployment is single-node (see {@link RequestLinkRateLimiter}), and the
+ * DELETE is idempotent anyway if that ever changes.
+ */
+@Component
+@RequiredArgsConstructor
+@Slf4j
+public class MagicLinkTokenCleanup {
+
+    private final MagicLinkTokenRepo tokens;
+    private final Clock clock;
+
+    /**
+     * Failures are logged rather than rethrown: an unhandled exception would cancel all future runs of a
+     * {@code fixedDelay} schedule, turning one bad sweep into a permanent one.
+     */
+    @Scheduled(
+            fixedDelayString = "${app.auth.token-cleanup-interval:1h}",
+            initialDelayString = "${app.auth.token-cleanup-interval:1h}")
+    public void purgeExpiredTokens() {
+        try {
+            final int removed = tokens.deleteExpired(clock.instant());
+            log.debug("Purged {} expired magic-link token(s)", removed);
+        } catch (final RuntimeException e) {
+            log.error("Failed to purge expired magic-link tokens; will retry next interval", e);
+        }
+    }
+}
diff --git a/src/main/java/org/patinanetwork/patchats/auth/UnregisteredEmailException.java b/src/main/java/org/patinanetwork/patchats/auth/UnregisteredEmailException.java
new file mode 100644
index 0000000..7974882
--- /dev/null
+++ b/src/main/java/org/patinanetwork/patchats/auth/UnregisteredEmailException.java
@@ -0,0 +1,17 @@
+package org.patinanetwork.patchats.auth;
+
+/**
+ * Thrown when a sign-in link is requested for an email with no member row. Maps to a 404 failure envelope so the login
+ * page can offer the two real choices — try another address, or sign up.
+ *
+ * <p>This is a <em>deliberate</em> disclosure of account existence, chosen over the previous silent-success behaviour
+ * because that left people waiting for an email that was never going to arrive. The request-link rate limiter is what
+ * keeps the disclosure from being cheap to farm; it runs before the existence check, so being throttled still reveals
+ * nothing.
+ */
+public class UnregisteredEmailException extends RuntimeException {
+
+    public UnregisteredEmailException() {
+        super("We couldn't find an account for that email.");
+    }
+}
diff --git a/src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepository.java b/src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepo.java
similarity index 69%
rename from src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepository.java
rename to src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepo.java
index 2adda9e..c7d1a77 100644
--- a/src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepository.java
+++ b/src/main/java/org/patinanetwork/patchats/auth/repo/MagicLinkTokenRepo.java
@@ -3,7 +3,6 @@
 import java.time.Instant;
 import java.time.ZoneOffset;
 import java.util.Optional;
-import java.util.UUID;
 import lombok.RequiredArgsConstructor;
 import org.springframework.jdbc.core.simple.JdbcClient;
 import org.springframework.stereotype.Repository;
@@ -11,21 +10,25 @@
 /** Plain-SQL access to {@code magic_link_tokens}. Only token hashes ever touch this table. */
 @Repository
 @RequiredArgsConstructor
-public class MagicLinkTokenRepository {
+public class MagicLinkTokenRepo {
 
     private final JdbcClient jdbc;
 
-    /** Invalidates every outstanding link for an email; called before issuing a new one. */
-    public void deleteByEmail(final String email) {
-        jdbc.sql("DELETE FROM magic_link_tokens WHERE email = :email")
-                .param("email", email)
+    /**
+     * Removes tokens past their TTL, keeping the table from growing without bound. Consumed-but-unexpired rows are left
+     * alone: they are already unusable, and they fall out on a later pass once their TTL lapses.
+     *
+     * @return how many rows were removed
+     */
+    public int deleteExpired(final Instant now) {
+        return jdbc.sql("DELETE FROM magic_link_tokens WHERE expires_at < :now")
+                .param("now", now.atOffset(ZoneOffset.UTC))
                 .update();
     }
 
-    public void insertToken(final UUID id, final String email, final String tokenHash, final Instant expiresAt) {
-        jdbc.sql("INSERT INTO magic_link_tokens (id, email, token_hash, expires_at)"
-                        + " VALUES (:id, :email, :tokenHash, :expiresAt)")
-                .param("id", id)
+    public void insertToken(final String email, final String tokenHash, final Instant expiresAt) {
+        jdbc.sql("INSERT INTO magic_link_tokens (email, token_hash, expires_at)"
+                        + " VALUES (:email, :tokenHash, :expiresAt)")
                 .param("email", email)
                 .param("tokenHash", tokenHash)
                 .param("expiresAt", expiresAt.atOffset(ZoneOffset.UTC))
diff --git a/src/main/java/org/patinanetwork/patchats/common/web/ApiExceptionHandler.java b/src/main/java/org/patinanetwork/patchats/common/web/ApiExceptionHandler.java
index a296418..8e84222 100644
--- a/src/main/java/org/patinanetwork/patchats/common/web/ApiExceptionHandler.java
+++ b/src/main/java/org/patinanetwork/patchats/common/web/ApiExceptionHandler.java
@@ -3,6 +3,7 @@
 import java.util.stream.Collectors;
 import org.patinanetwork.patchats.auth.InvalidMagicLinkException;
 import org.patinanetwork.patchats.auth.TooManyLinkRequestsException;
+import org.patinanetwork.patchats.auth.UnregisteredEmailException;
 import org.patinanetwork.patchats.common.dto.ApiResponder;
 import org.patinanetwork.patchats.common.web.exception.MemberDuplicateException;
 import org.patinanetwork.patchats.common.web.exception.MemberNotFoundException;
@@ -41,6 +42,11 @@ public ResponseEntity<ApiResponder<Void>> handleInvalidMagicLink(final InvalidMa
         return ResponseEntity.badRequest().body(ApiResponder.failure(ex.getMessage()));
     }
 
+    @ExceptionHandler(UnregisteredEmailException.class)
+    public ResponseEntity<ApiResponder<Void>> handleUnregisteredEmail(final UnregisteredEmailException ex) {
+        return ResponseEntity.status(HttpStatus.NOT_FOUND).body(ApiResponder.failure(ex.getMessage()));
+    }
+
     @ExceptionHandler(TooManyLinkRequestsException.class)
     public ResponseEntity<ApiResponder<Void>> handleTooManyLinkRequests(final TooManyLinkRequestsException ex) {
         return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS).body(ApiResponder.failure(ex.getMessage()));
diff --git a/src/main/java/org/patinanetwork/patchats/utilities/EmailNormalizer.java b/src/main/java/org/patinanetwork/patchats/utilities/EmailNormalizer.java
new file mode 100644
index 0000000..aeaa9ad
--- /dev/null
+++ b/src/main/java/org/patinanetwork/patchats/utilities/EmailNormalizer.java
@@ -0,0 +1,20 @@
+package org.patinanetwork.patchats.utilities;
+
+import java.util.Locale;
+
+/**
+ * The single definition of how an email address is canonicalised before it is stored or looked up.
+ *
+ * <p>Member lookups match the column exactly ({@code WHERE email = :email}), so every write and every read has to agree
+ * on one form or rows become unreachable. Callers on both sides of that boundary — sign-up creating the row, auth
+ * finding it — must run addresses through here rather than rolling their own trim/lowercase.
+ */
+public final class EmailNormalizer {
+
+    private EmailNormalizer() {}
+
+    /** Trims surrounding whitespace and lowercases in a locale-independent way. */
+    public static String normalize(final String email) {
+        return email.trim().toLowerCase(Locale.ROOT);
+    }
+}
diff --git a/src/main/resources/application-dev.yml b/src/main/resources/application-dev.yml
new file mode 100644
index 0000000..52155f1
--- /dev/null
+++ b/src/main/resources/application-dev.yml
@@ -0,0 +1,5 @@
+app:
+  auth:
+    base-url: ${APP_BASE_URL:http://localhost:5173}
+    # Dev runs plain HTTP through the Vite proxy; a Secure cookie would be silently dropped.
+    cookie-secure: false
diff --git a/src/main/resources/application-smtp.yml b/src/main/resources/application-smtp.yml
new file mode 100644
index 0000000..d20aca4
--- /dev/null
+++ b/src/main/resources/application-smtp.yml
@@ -0,0 +1,22 @@
+# Local profile for exercising real SMTP delivery. Identical to `dev` except that it is not named `dev`, so
+# SmtpEmailSender (@Profile("!dev")) wins over LoggingEmailSender and mail actually leaves the machine.
+#
+# Defaults target a local Mailpit catcher (`mailpit`, SMTP :1025, inbox at http://localhost:8025), which takes no
+# credentials. Point SMTP_* at a real provider in .env to test genuine delivery — set SMTP_AUTH and SMTP_STARTTLS
+# back to true when you do.
+spring:
+  mail:
+    host: ${SMTP_HOST:localhost}
+    port: ${SMTP_PORT:1025}
+    properties:
+      mail:
+        smtp:
+          auth: ${SMTP_AUTH:false}
+          starttls:
+            enable: ${SMTP_STARTTLS:false}
+
+app:
+  auth:
+    base-url: ${APP_BASE_URL:http://localhost:5173}
+    # Local runs are plain HTTP through the Vite proxy; a Secure cookie would be silently dropped.
+    cookie-secure: false
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 848cb2e..c594af8 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -6,6 +6,10 @@ spring:
   flyway:
     # Migrations run out-of-band via the Flyway Maven plugin (`just migrate`), never at startup.
     enabled: false
+  session:
+    timeout: 30d
+    jdbc:
+      initialize-schema: never
   mail:
     host: ${SMTP_HOST:}
     port: ${SMTP_PORT:587}
@@ -18,9 +22,20 @@ spring:
           starttls:
             enable: true
 
+server:
+  # Trust X-Forwarded-* from the reverse proxy so rate limiting sees real client IPs.
+  forward-headers-strategy: framework
+
 app:
   commit:
     sha: "@commit.sha@"
   email:
     from: ${EMAIL_FROM:coffeechats@patinanetwork.org}
-    from-name: ${EMAIL_FROM_NAME:PatChats}
\ No newline at end of file
+    from-name: ${EMAIL_FROM_NAME:PatChats}
+  auth:
+    # Public origin of the SPA; magic links point at <base-url>/auth/verify?token=...
+    base-url: ${APP_BASE_URL:http://patchats.patinanetwork.org}
+    cookie-secure: ${AUTH_COOKIE_SECURE:true}
+    magic-link-ttl: 15m
+    # How often expired magic-link rows are swept; nothing else deletes them.
+    token-cleanup-interval: 15d
diff --git a/src/test/java/org/patinanetwork/patchats/auth/AuthControllerTest.java b/src/test/java/org/patinanetwork/patchats/auth/AuthControllerTest.java
index 5be54c6..c392098 100644
--- a/src/test/java/org/patinanetwork/patchats/auth/AuthControllerTest.java
+++ b/src/test/java/org/patinanetwork/patchats/auth/AuthControllerTest.java
@@ -3,6 +3,7 @@
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -52,6 +53,20 @@ void requestLinkAlwaysReturnsGenericMessage() throws Exception {
         verify(authService).requestLink(eq("ann@example.com"), anyString());
     }
 
+    @Test
+    void requestLinkMapsUnregisteredEmailToNotFoundEnvelope() throws Exception {
+        doThrow(new UnregisteredEmailException())
+                .when(authService)
+                .requestLink(eq("stranger@example.com"), anyString());
+
+        mockMvc.perform(post("/api/auth/request-link")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"email\":\"stranger@example.com\"}"))
+                .andExpect(status().isNotFound())
+                .andExpect(jsonPath("$.success").value(false))
+                .andExpect(jsonPath("$.message").value("We couldn't find an account for that email."));
+    }
+
     @Test
     void requestLinkRejectsMalformedEmail() throws Exception {
         mockMvc.perform(post("/api/auth/request-link")
diff --git a/src/test/java/org/patinanetwork/patchats/auth/AuthServiceTest.java b/src/test/java/org/patinanetwork/patchats/auth/AuthServiceTest.java
index 638c713..afbc16b 100644
--- a/src/test/java/org/patinanetwork/patchats/auth/AuthServiceTest.java
+++ b/src/test/java/org/patinanetwork/patchats/auth/AuthServiceTest.java
@@ -21,13 +21,13 @@
 import org.mockito.ArgumentCaptor;
 import org.patinanetwork.patchats.api.member.db.models.Member;
 import org.patinanetwork.patchats.api.member.db.repos.MemberRepo;
-import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepository;
+import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepo;
 
 class AuthServiceTest {
 
     private static final Instant NOW = Instant.parse("2026-07-03T12:00:00Z");
 
-    private final MagicLinkTokenRepository tokens = mock(MagicLinkTokenRepository.class);
+    private final MagicLinkTokenRepo tokens = mock(MagicLinkTokenRepo.class);
     private final MemberRepo members = mock(MemberRepo.class);
     private final MagicLinkEmailComposer emailComposer = mock(MagicLinkEmailComposer.class);
     private final RequestLinkRateLimiter rateLimiter = mock(RequestLinkRateLimiter.class);
@@ -55,14 +55,14 @@ void requestLinkNormalizesEmailAndStoresHashNotRaw() {
 
         authService.requestLink("  Ann@Example.COM ", "10.0.0.1");
 
-        verify(tokens).deleteByEmail("ann@example.com");
         final ArgumentCaptor<String> hash = ArgumentCaptor.forClass(String.class);
         final ArgumentCaptor<Instant> expiry = ArgumentCaptor.forClass(Instant.class);
-        verify(tokens).insertToken(any(UUID.class), eq("ann@example.com"), hash.capture(), expiry.capture());
+        verify(tokens).insertToken(eq("ann@example.com"), hash.capture(), expiry.capture());
         final ArgumentCaptor<String> raw = ArgumentCaptor.forClass(String.class);
         verify(emailComposer).send(eq("ann@example.com"), raw.capture());
 
-        // The emailed value and the stored value must differ, and the stored one is the SHA-256 of the raw.
+        // The emailed value and the stored value must differ, and the stored one is the
+        // SHA-256 of the raw.
         assertNotEquals(raw.getValue(), hash.getValue());
         assertEquals(TokenGenerator.hash(raw.getValue()), hash.getValue());
         assertEquals(NOW.plus(properties.getMagicLinkTtl()), expiry.getValue());
diff --git a/src/test/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanupTest.java b/src/test/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanupTest.java
new file mode 100644
index 0000000..b932da2
--- /dev/null
+++ b/src/test/java/org/patinanetwork/patchats/auth/MagicLinkTokenCleanupTest.java
@@ -0,0 +1,38 @@
+package org.patinanetwork.patchats.auth;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import org.junit.jupiter.api.Test;
+import org.patinanetwork.patchats.auth.repo.MagicLinkTokenRepo;
+
+class MagicLinkTokenCleanupTest {
+
+    private static final Instant NOW = Instant.parse("2026-07-03T12:00:00Z");
+
+    private final MagicLinkTokenRepo tokens = mock(MagicLinkTokenRepo.class);
+
+    private final MagicLinkTokenCleanup cleanup = new MagicLinkTokenCleanup(tokens, Clock.fixed(NOW, ZoneOffset.UTC));
+
+    @Test
+    void purgeDeletesEverythingExpiredAsOfNow() {
+        when(tokens.deleteExpired(NOW)).thenReturn(3);
+
+        cleanup.purgeExpiredTokens();
+
+        verify(tokens).deleteExpired(NOW);
+    }
+
+    @Test
+    void purgeSwallowsFailuresSoTheScheduleSurvives() {
+        when(tokens.deleteExpired(NOW)).thenThrow(new IllegalStateException("connection reset"));
+
+        // A thrown exception would cancel every future run of the fixed-delay schedule.
+        assertDoesNotThrow(cleanup::purgeExpiredTokens);
+    }
+}
diff --git a/src/test/java/org/patinanetwork/patchats/utilities/EmailNormalizerTest.java b/src/test/java/org/patinanetwork/patchats/utilities/EmailNormalizerTest.java
new file mode 100644
index 0000000..5b3a2fb
--- /dev/null
+++ b/src/test/java/org/patinanetwork/patchats/utilities/EmailNormalizerTest.java
@@ -0,0 +1,31 @@
+package org.patinanetwork.patchats.utilities;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.Locale;
+import org.junit.jupiter.api.Test;
+
+class EmailNormalizerTest {
+
+    @Test
+    void trimsAndLowercases() {
+        assertEquals("ann@example.com", EmailNormalizer.normalize("  Ann@Example.COM  "));
+    }
+
+    @Test
+    void leavesAnAlreadyCanonicalAddressUnchanged() {
+        assertEquals("ann@example.com", EmailNormalizer.normalize("ann@example.com"));
+    }
+
+    @Test
+    void lowercasesIndependentlyOfTheDefaultLocale() {
+        final Locale original = Locale.getDefault();
+        try {
+            // Turkish lowercases 'I' to a dotless 'ı'; the canonical form must not depend on where the server runs.
+            Locale.setDefault(Locale.forLanguageTag("tr"));
+            assertEquals("iris@example.com", EmailNormalizer.normalize("IRIS@EXAMPLE.COM"));
+        } finally {
+            Locale.setDefault(original);
+        }
+    }
+}