feat(account): self-service login email change with double confirmation (#2017)

* feat(account): self-service login email change with double confirmation

New POST /api/account/email requests the change via the user session so
Supabase's AAL2 guard applies, and the account settings page gets an email
row with pending-confirmation state. Confirmation mails (both addresses)
and the /auth/callback email_change verification already existed; this
wires the missing initiation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* feat(account): map email_exists to a 409 with Swedish copy

Changing to an address that already has an account is refused by GoTrue
(addresses are unique per auth user); surface that as a clear conflict
instead of the generic fallback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(account): trusted redirect origin + profiles.email sync trigger (skeptic findings)

- emailRedirectTo now derives from resolveRequestAppOrigin(): request.url
  can be an internal origin behind a proxy (dead confirmation links on
  self-hosted) and auth links must not follow attacker-chosen hosts;
  registered white-label hosts keep their brand.
- New migration 20260828191950: sync_profile_email trigger mirrors
  auth.users.email changes into profiles.email (member lists, notification
  recipients, AGI/KU contact, invite dedup all read profiles.email), plus a
  backfill for already-diverged rows. pg-real test included.
- Save button disabled while the same address awaits confirmation (no
  rate-limit re-fires); GoTrue's 'error sending email change email' now maps
  to the Swedish SMTP guidance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

* fix(account): idempotent repeat request for the pending address

CodeRabbit follow-up: a second POST for the address already awaiting
confirmation now returns the pending state without another GoTrue round
trip (no duplicate confirmation mails, no rate-limit burn). Claims-mapped
sessions lack new_email; GoTrue's send rate limit remains the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

supabase/migrations/20260828191950_sync_profile_email_on_auth_email_change.sql

@@ -0,0 +1,34 @@
+-- Keep public.profiles.email in step with auth.users.email.
+--
+-- profiles.email is written once by handle_new_user (20240101000001) and was
+-- never updated again; with self-service email change (PR #2017) the login
+-- address can now legitimately change, and everything that reads
+-- profiles.email (member lists, notification recipients in
+-- lib/notifications/member-email.ts, AGI/KU contact fields, invite dedup)
+-- would keep pointing at the dead address forever. Mirror the change with a
+-- trigger so every path (self-service, admin API, SQL) stays in sync.
+
+create or replace function public.sync_profile_email()
+returns trigger as $$
+begin
+  update public.profiles
+     set email = new.email
+   where id = new.id
+     and email is distinct from new.email;
+  return new;
+end;
+$$ language plpgsql security definer set search_path = public;
+
+create trigger on_auth_user_email_updated
+  after update of email on auth.users
+  for each row
+  when (new.email is distinct from old.email)
+  execute function public.sync_profile_email();
+
+-- Backfill rows that already diverged (e.g. admin-side email changes made
+-- before this trigger existed).
+update public.profiles p
+   set email = u.email
+  from auth.users u
+ where u.id = p.id
+   and p.email is distinct from u.email;