fix(auth): email-change recovery re-send and confirmation feedback (#2034)

* fix(auth): email-change recovery re-send and confirmation feedback

A half-completed secure email change was a dead end: the pending-address
short-circuit in /api/account/email swallowed every retry without
re-sending mails, so once the confirmation links expired the user could
never recover, and confirmation clicks landed on the dashboard with no
feedback at all.

- /api/account/email: only short-circuit a repeat request while the
  pending mails are fresh (30 min); a stale pending change falls through
  to GoTrue, which restarts the change and re-sends both mails
- /auth/callback: type=email_change now redirects to a status page
  (/auth/email-change) that says whether one click remains, the change
  is complete, or the link was dead, instead of landing silently
- auth mail templates: both email-change mails explain that two mails
  are sent and both links must be clicked
- settings: the save button re-enables for the pending address as
  Skicka igen, so users can trigger the re-send themselves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings)

- middleware: let /auth/email-change and /auth/callback?type=email_change
  through for authenticated users; the bounce to / swallowed confirmation
  clicks before verifyOtp ran (pre-existing since #2017)
- email-change done page resolves the WL-14 landing destination for the CTA
- /api/account/email returns resent flag; settings toast says mails were
  already sent instead of claiming a fresh send

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/email/__tests__/auth-templates.test.ts

@@ -49,6 +49,18 @@ describe('buildAuthEmail', () => {
     expect(mail.text).toMatchSnapshot()
   })
 
+  it('tells the user both mails must be clicked for an email change', () => {
+    for (const actionType of ['email_change', 'email_change_current'] as const) {
+      const mail = buildAuthEmail({
+        actionType,
+        appName: 'Siffra',
+        actionUrl: URL_EXAMPLE,
+      })
+      expect(mail.text).toContain('två mail')
+      expect(mail.text).toContain('länken i båda')
+    }
+  })
+
   it('renders the reauthentication code without a link', () => {
     const mail = buildAuthEmail({
       actionType: 'reauthentication',

lib/email/auth-templates.ts

@@ -60,14 +60,14 @@ const CONTENT: Record<AuthEmailActionType, AuthEmailContent> = {
     subject: 'Bekräfta din nya e-postadress',
     heading: 'Bekräfta din nya e-postadress',
     body: (appName) =>
-      `Klicka på knappen nedan för att bekräfta din nya e-postadress hos ${appName}.`,
+      `Klicka på knappen nedan för att bekräfta din nya e-postadress hos ${appName}. Av säkerhetsskäl skickas två mail, ett till din nya adress och ett till din nuvarande. Bytet slutförs först när du klickat på länken i båda.`,
     cta: 'Bekräfta ny e-postadress',
   },
   email_change_current: {
     subject: 'Godkänn ändrad e-postadress',
     heading: 'Godkänn ändrad e-postadress',
     body: (appName) =>
-      `En ändring av e-postadressen för ditt konto hos ${appName} har begärts. Klicka på knappen nedan för att godkänna ändringen från din nuvarande adress.`,
+      `En ändring av e-postadressen för ditt konto hos ${appName} har begärts. Klicka på knappen nedan för att godkänna ändringen från din nuvarande adress. Av säkerhetsskäl skickas två mail, ett till din nuvarande adress och ett till din nya. Bytet slutförs först när du klickat på länken i båda.`,
     cta: 'Godkänn ändringen',
   },
   reauthentication: {