Secure Auth System with React

I’m building a new app and need a straightforward, secure authentication module that I can drop straight into the code-base. Here’s the scope I have in mind:

• Core flow

– Email + password sign-up and login, with passwords hashed using bcrypt or equivalent best-practice library.
– Stateless sessions handled through JWT.
– Post-sign-up email verification, and a full “Forgot password” flow that sends a reset link.
– All transactional emails must be dispatched through Mailgun.

• Front-end

– React pages for Sign In, Sign Up, and Forgot / Reset Password.
– Keep the UI minimalistic and clean; friendly success and error messages so users know exactly what’s happening.

• Back-end

– Node.js with Express, exposed as clean REST endpoints.
– Secrets (JWT keys, Mailgun credentials, etc.) pulled exclusively from environment variables.

Nice-to-haves (only if you have bandwidth): Google and/or GitHub social login, plus optional 2-factor authentication.

Deliverables
1. Complete source code for the Node/Express API and React pages.
2. A concise README covering local setup, environment variables, and a quick endpoint guide.
3. Any additional configuration needed for Mailgun to work out of the box.

If everything above is clear, let me know your estimated turnaround and any clarifying questions. Looking forward to working with you!