Cherry pick for patch

[teelur]

• Email updates
• CVE fix

[Copilot]

Pull request overview

This pull request is a cherry-pick for patch containing email updates and a CVE fix related to X-Forwarded-Proto header handling. The changes improve security, enhance the email notification system, and upgrade dependencies.

Changes:

• Fixed CVE vulnerability in X-Forwarded-Proto header parsing to prevent header injection attacks
• Migrated email sender from System.Net.Mail to MailKit for better SMTP support and security
• Enhanced login flow with account lockout email notifications and better error differentiation (wrong password vs unverified email)
• Added RegisterResponse to indicate whether email confirmation is required
• Updated frontend dependencies and improved registration/login UI with resend verification email functionality

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
server/BudgetBoard.WebAPI/Utils/Helpers.cs	Fixed CVE by properly parsing comma-separated X-Forwarded-Proto headers and using request.Scheme as fallback instead of request.Protocol
server/BudgetBoard.WebAPI/Utils/EmailSender.cs	Migrated from System.Net.Mail to MailKit with proper connection management and better error handling
server/BudgetBoard.WebAPI/Resources/ApiResponseStrings.resx	Added localized error messages and account lockout email content
server/BudgetBoard.WebAPI/Overrides/RegisterResponse.cs	New model to communicate email confirmation requirements to client
server/BudgetBoard.WebAPI/Overrides/IdentityApiEndpointRouteBuilderExtensions.cs	Enhanced login flow with lockout detection, email notifications, and better error messages; updated register endpoint to return RegisterResponse
server/BudgetBoard.WebAPI/BudgetBoard.WebAPI.csproj	Updated Microsoft packages to 10.0.3, added MailKit 4.15.0 dependency
server/BudgetBoard.Tests/BudgetBoard.IntegrationTests.csproj	Updated test dependencies to match main project versions
server/BudgetBoard.Service/Resources/LogStrings.resx	Removed unused log string entry
server/BudgetBoard.Service/BudgetBoard.Service.csproj	Updated Microsoft.Extensions packages to 10.0.3
server/BudgetBoard.Database/BudgetBoard.Database.csproj	Updated Microsoft packages to 10.0.3
client/yarn.lock	Updated client-side dependencies including Babel, Mantine, React, ESLint, TypeScript, and Vite
client/src/models/auth.ts	New TypeScript interface for RegisterResponse
client/src/app/Unauthorized/Register/Register.tsx	Updated to handle conditional email verification message based on server response
client/src/app/Unauthorized/Login/Login.tsx	Added resend verification email functionality with better error handling for unverified accounts
client/public/locales/fr/translation.json	Reformatted with 2-space indentation and added partial translations for new features
client/public/locales/en-us/translation.json	Added translations for account lockout, verification email resend, and split account_created messages
client/public/locales/de/translation.json	Reformatted with 2-space indentation
client/package.json	Updated all dependencies to latest versions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.