Validate magic-link, set 90-day cookie, AND render a confirmation page whose Continue button carries a short-TTL signed unlock_ok param.

The URL param is a cookie-loss fallback: some mobile email clients open links in isolated in-app browsers that don't persist cookies to the user's default browser. The short-lived signed param lets this one session still unlock even if the cookie is dropped on the redirect.