fix(auth): email-change recovery re-send and confirmation feedback (#2034)

* fix(auth): email-change recovery re-send and confirmation feedback

A half-completed secure email change was a dead end: the pending-address
short-circuit in /api/account/email swallowed every retry without
re-sending mails, so once the confirmation links expired the user could
never recover, and confirmation clicks landed on the dashboard with no
feedback at all.

- /api/account/email: only short-circuit a repeat request while the
  pending mails are fresh (30 min); a stale pending change falls through
  to GoTrue, which restarts the change and re-sends both mails
- /auth/callback: type=email_change now redirects to a status page
  (/auth/email-change) that says whether one click remains, the change
  is complete, or the link was dead, instead of landing silently
- auth mail templates: both email-change mails explain that two mails
  are sent and both links must be clicked
- settings: the save button re-enables for the pending address as
  Skicka igen, so users can trigger the re-send themselves

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings)

- middleware: let /auth/email-change and /auth/callback?type=email_change
  through for authenticated users; the bounce to / swallowed confirmation
  clicks before verifyOtp ran (pre-existing since #2017)
- email-change done page resolves the WL-14 landing destination for the CTA
- /api/account/email returns resent flag; settings toast says mails were
  already sent instead of claiming a fresh send

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/supabase/__tests__/middleware.test.ts

@@ -525,6 +525,28 @@ describe('updateSession redirect destinations', () => {
       expect(locationOf(await run('/sandbox?next=%2Fsettings%2Ftax'))).toBe(`${ORIGIN}/`)
       expect(locationOf(await run('/auth/callback?next=%2Fsettings%2Ftax'))).toBe(`${ORIGIN}/`)
     })
+
+    // Email-change confirmation links are usually clicked while still logged
+    // in (the change starts in settings), and the completing verify mints a
+    // session before the status page renders. Bouncing either request off the
+    // /auth prefix silently swallowed the confirmation.
+    it('lets an authenticated email-change confirmation reach the callback', async () => {
+      const response = await run('/auth/callback?token_hash=abc&type=email_change')
+      expect(response.status).not.toBe(307)
+      expect(locationOf(response)).toBeNull()
+    })
+
+    it('lets an authenticated user see the email-change status page', async () => {
+      const response = await run('/auth/email-change?status=done')
+      expect(response.status).not.toBe(307)
+      expect(locationOf(response)).toBeNull()
+    })
+
+    it('still bounces other authenticated token types off the callback', async () => {
+      expect(locationOf(await run('/auth/callback?token_hash=abc&type=signup'))).toBe(
+        `${ORIGIN}/`,
+      )
+    })
   })
 
   // ── Sites 2 and 3: MFA step-up and forced enrollment ──────────────────

lib/supabase/middleware.ts

@@ -282,6 +282,21 @@ async function updateSessionInner(
     return supabaseResponse
   }
 
+  // Email-change confirmations are reachable in both auth states, for the
+  // same reason as /reset-password above. The change starts in settings, so
+  // the confirmation links are usually clicked while still logged in, and the
+  // completing verify mints a fresh session itself. Bouncing authenticated
+  // requests off these paths (a) dropped the confirmation click before
+  // verifyOtp could consume the token, so the change never completed, and
+  // (b) hid the /auth/email-change status page in exactly the success case.
+  if (
+    pathname.startsWith('/auth/email-change') ||
+    (pathname.startsWith('/auth/callback') &&
+      request.nextUrl.searchParams.get('type') === 'email_change')
+  ) {
+    return supabaseResponse
+  }
+
   // Public agent-discovery + API docs surfaces. /llms.txt and /llms-full.txt
   // exist FOR anonymous consumers (the llms.txt convention targets logged-out
   // crawlers and IDE agents), and /docs is the public API documentation the