meteor-accountslisted

# Meteor accounts `accounts-base` plus a flavor package (`accounts-password`, `accounts-google`, etc.). Meteor stores users in `Meteor.users` and ships the client a resume token mapped to that document. ## Decision flow 1. Username + password? Add `accounts-password`. 2. Social login? Add `accounts-base` plus the provider package (e.g. `accounts-google`) and configure the service. 3. Magic-link? Add `accounts-passwordless`. 4. 2FA? Layer `accounts-2fa` on top of `accounts-password`. 5. Token storage on the client? Default is Web Storage. Meteor 3.3+ supports an HttpOnly cookie flow; see the section below. ## Username + password ```javascript // server/accounts.js import { Accounts } from "meteor/accounts-base"; import { Meteor } from "meteor/meteor"; Meteor.startup(() => { Accounts.config({ sendVerificationEmail: true, }); Accounts.emailTemplates.siteName = "My App"; Accounts.emailTemplates.from = "no-reply@example.com"; }); ``` The `from` address is required; Meteor 3.5+ logs a server warning if you omit it. Do not set `forbidClientAccountCreation: true` when the client signup form calls `Accounts.createUser` or `Accounts.createUserAsync`. The server rejects that request with `403 Signups forbidden`. For invite-only or administrator provisioning, set the option on both client and server, remove the public signup UI, and call `Accounts.createUserAsync` only from trusted server code after its own authorization check. ```javascript // client/signin.j