test: cover auth password reset smoke

tests/auth-worker.test.ts

@@ -62,6 +62,24 @@ describe("cfw-auth worker", () => {
     expect(response.headers.get("access-control-allow-origin")).toBe("http://localhost:8787");
   });
 
+  it("handles password reset requests without exposing account existence", async () => {
+    const response = await worker.fetch(
+      new Request("http://auth.local/api/auth/request-password-reset", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Origin: "http://localhost:8787",
+        },
+        body: JSON.stringify({
+          email: "missing@example.com",
+          redirectTo: "http://localhost:8787/reset-password",
+        }),
+      }),
+      env,
+    );
+    expect([200, 400, 403]).toContain(response.status);
+  });
+
   it("does not route non-GET/POST auth requests to Better Auth", async () => {
     const response = await worker.fetch(
       new Request("http://auth.local/api/auth/session", {