fix(auth): email-change recovery re-send and confirmation feedback (#2034)

* fix(auth): email-change recovery re-send and confirmation feedback

A half-completed secure email change was a dead end: the pending-address
short-circuit in /api/account/email swallowed every retry without
re-sending mails, so once the confirmation links expired the user could
never recover, and confirmation clicks landed on the dashboard with no
feedback at all.

- /api/account/email: only short-circuit a repeat request while the
  pending mails are fresh (30 min); a stale pending change falls through
  to GoTrue, which restarts the change and re-sends both mails
- /auth/callback: type=email_change now redirects to a status page
  (/auth/email-change) that says whether one click remains, the change
  is complete, or the link was dead, instead of landing silently
- auth mail templates: both email-change mails explain that two mails
  are sent and both links must be clicked
- settings: the save button re-enables for the pending address as
  Skicka igen, so users can trigger the re-send themselves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings)

- middleware: let /auth/email-change and /auth/callback?type=email_change
  through for authenticated users; the bounce to / swallowed confirmation
  clicks before verifyOtp ran (pre-existing since #2017)
- email-change done page resolves the WL-14 landing destination for the CTA
- /api/account/email returns resent flag; settings toast says mails were
  already sent instead of claiming a fresh send

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

components/settings/sections/AccountSettingsContent.tsx

@@ -128,8 +128,12 @@ export function AccountSettingsContent() {
         return
       }
       setPendingEmail(trimmed)
+      const resent = (json as { data?: { resent?: boolean } } | null)?.data?.resent
       toast({
-        title: tSettings('email_change_requested'),
+        title:
+          resent === false
+            ? tSettings('email_change_already_pending')
+            : tSettings('email_change_requested'),
         description: tSettings('email_change_requested_help'),
       })
     } catch (err) {
@@ -242,11 +246,14 @@ export function AccountSettingsContent() {
                 !currentEmail ||
                 savingEmail ||
                 !email.trim() ||
-                email.trim().toLowerCase() === currentEmail.toLowerCase() ||
-                email.trim().toLowerCase() === pendingEmail
+                email.trim().toLowerCase() === currentEmail.toLowerCase()
               }
             >
-              {savingEmail ? tCommon('saving') : tCommon('save')}
+              {savingEmail
+                ? tCommon('saving')
+                : email.trim().toLowerCase() === pendingEmail
+                  ? tSettings('email_resend')
+                  : tCommon('save')}
             </Button>
           </SettingsRowEnd>
         </SettingsRow>