Sign in with email or handle plus a password (hashed with scrypt and a per-user salt), or with Google or X.
You can attach multiple sign-in methods to one account. Unlinking is refused when it would leave you with no way in.
Account linking resolves in a strict order: a known identity signs in; a provider-verified email matching an existing account links to it; otherwise a new account is created. Linking on an unverified email would let anyone who can obtain a token for an address take over the matching account, so that path is closed.
Wrong password and unknown user return an identical message. Distinguishing them hands an attacker a free account-enumeration oracle.
A password reset destroys every session — that is the point of a reset.