feat(identity): confirm email changes with owner-configured mail

[akemmanuel]

Summary

Refs #154 with the revised, approved scope: optional owner-configured SMTP and confirmed changes to a signed-in user's own contact email. No email/password recovery is added. Existing username login, profile editing, and owner-operated member password reset remain.

• Owner-only mail configuration/test controls; secrets use the existing protected Host state, with explicit keep/replace/clear behavior.
• Reauthenticate the current password, send a single-use 30-minute new-inbox confirmation link, and replace the stored email only through an atomic confirmation transaction. Notify the previous address best-effort.
• Bind challenges to the credential epoch before asynchronous verification, recheck before reservation/finalization/consumption, and retire outstanding challenges on password change, owner reset, or removal.
• Preserve rate history across cancellation/send failures; bound failed reauthentication and Host-wide work; release issuance serialization before network delivery.
• Require TLS off loopback, validate a bare public origin and single simple mailbox, keep tokens in exact URL fragments, handle StrictMode exactly once, and bound total SMTP delivery at 40 seconds with deterministic cleanup.
• Update existing profile/System settings UI, mail templates, and English/German/Spanish translations together. Preserve failed-save drafts.

Review and verification

Independent final read-only security review found no blocking defects after corrections. Parent tests reproduced the credential-rotation-during-verification race, unbounded total SMTP delivery, and mailbox-list acceptance before fixing them.

Fresh independent parent verification: 385 passed across 53 identity/routes/Host/frontend/i18n files, plus pnpm run check, pnpm run slop-check, and git diff --check passed. Tests cover real routes, authentication, SQLite transactions, protected Host secret state, credential races, limits, and React effects; mail delivery uses injected/offline transports.

Explicit limits

• No real SMTP delivery, production configuration, deployed acceptance, or deployment was performed. Mail stays off until configured by the owner.
• Public confirmation shares a Host-wide budget, not an IP-based one; anonymous traffic can temporarily delay email changes. Login is unaffected.
• Trusted-team authenticated address-enumeration parity is documented. Interrupted deliveries/settings saves can require owner/user retry; metadata and secret storage are separate authorities.
• The original password-recovery request is intentionally not claimed implemented or closed.