Auth screens reject valid emails: inline regex caps TLD at 4 characters (locks users out of sign-up, sign-in AND password reset)

[teetangh]

Summary

All three auth screens validate email with a duplicated inline regex that caps the TLD at 4 characters:

RegExp(r'^[\w-\.]+@([\w-]+\.)+[\w-]{2,4}$')

• lib/features/auth/screens/sign_in_screen.dart:134
• lib/features/auth/screens/sign_up_screen.dart:173
• lib/features/auth/screens/forgot_password_screen.dart:108

Meanwhile the shared validator in lib/core/utils/validators.dart:10 is correct and permissive:

RegExp(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')

…but none of the three screens use it.

Impact

Anyone whose email has a TLD longer than 4 characters is completely locked out: they cannot sign up, cannot sign in, and cannot even reset their password, because all three entry points share the same faulty rule. The failure is also silent from the backend's perspective — no request is ever sent, so there's nothing in the logs.

Affected TLDs include ones plausible for this product's audience:

Address	Result
someone@acme.online	rejected
someone@acme.agency	rejected
someone@acme.consulting	rejected
someone@acme.co.uk	accepted (uk is 2 chars)
someone@acme.com	accepted

.online, .agency, .consulting, .digital, .services are all realistic for consultants signing up to a consulting marketplace.

Reproduction

1. Run the app (web or mobile) against any backend.
2. Go to Sign In.
3. Enter test@example.online and any password.
4. Field shows "Please enter a valid email"; no network request is made.

Found while signing in with docker.demo@test.local during local Docker stack verification — .local (5 chars) was rejected, while the identical credentials succeeded via curl against the same backend.

Suggested fix

Replace all three inline regexes with the existing shared validator:

validator: Validators.email,

That removes the duplication and the divergence in one move. Note the user-visible copy differs slightly too — the inline versions say "Please enter a valid email", Validators.email says "Please enter a valid email address" — so this also unifies the message.

Worth a quick grep afterwards for any other inline email regexes; lib/core/extensions/string_extensions.dart:32 has another copy that should be checked for the same drift.