fix(signin): key the resend cooldown to the address it was set for (#20)

The email-step Send button disabled on any running cooldown, so a merchant
who mistyped their address was locked out of sending to the corrected one
for the rest of the 60s window — a guard the server never had: request_code
enforces the cooldown per address (SD-0001 INV-3 -> PUC-2c).

Track which address the running cooldown belongs to (cooldownFor) and gate
the email-step button through cooldownAppliesTo(), which blocks only while
the countdown runs AND the input normalizes (strip+lowercase, mirroring
normalize_email / INV-2) to that address. Same address still shows the
honest 'Resend in Ns'; any other address sends immediately. The code-step
resend is unchanged. Verified in the live UI (wrong address -> Wrong
address? -> corrected address sends at once).

package-lock.json: sync recorded version with package.json (0.4.0).

Closes #20

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/screens/SignIn.tsx

@@ -3,6 +3,7 @@
 // is handled by App on success. Visuals per the ui/designs export (hf-signin).
 import { useEffect, useState } from "react";
 import { requestCode, verifyCode, type ApiError, type VerifyResult } from "../api";
+import { cooldownAppliesTo } from "../cooldown";
 import CodeInput from "../ui/CodeInput";
 import { AuthCard, Banner, Field, Footer, PrimaryButton, Screen, TopBar, Wordmark } from "../ui/kit";
 
@@ -34,6 +35,9 @@ export default function SignIn({ door, onAuthed, onBack }: Props) {
   const [codeError, setCodeError] = useState<string | null>(null);
   const [bannerError, setBannerError] = useState<ApiError | null>(null);
   const [cooldown, setCooldown] = useCooldown();
+  // The address the running cooldown belongs to — the server's cooldown is per-address
+  // (INV-3), so a different address must not be blocked by it (bug #20).
+  const [cooldownFor, setCooldownFor] = useState<string | null>(null);
 
   function applyError(err: ApiError) {
     setFieldError(null);
@@ -53,9 +57,11 @@ export default function SignIn({ door, onAuthed, onBack }: Props) {
     setBusy(false);
     if (err) {
       applyError(err);
+      if (err.code === "resend_cooldown") setCooldownFor(email);
       return err.code === "resend_cooldown"; // a cooldown still means a code is out there
     }
     setCooldown(60);
+    setCooldownFor(email);
     return true;
   }
 
@@ -131,8 +137,12 @@ export default function SignIn({ door, onAuthed, onBack }: Props) {
                 }}
               />
               <div style={{ display: "flex", flexDirection: "column", gap: 12 }}>
-                <PrimaryButton busy={busy} disabled={cooldown > 0}>
-                  {busy ? "Sending…" : cooldown > 0 ? `Resend in ${cooldown}s` : "Send code"}
+                <PrimaryButton busy={busy} disabled={cooldownAppliesTo(email, cooldownFor, cooldown)}>
+                  {busy
+                    ? "Sending…"
+                    : cooldownAppliesTo(email, cooldownFor, cooldown)
+                      ? `Resend in ${cooldown}s`
+                      : "Send code"}
                 </PrimaryButton>
                 <p className="note">
                   We'll email you a one-time code. That's all we need — no password, ever.