R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

CLAUDE.md

@@ -406,6 +406,20 @@ group www-data and reaches the private mongod; `sudo -u www-data` works too.
   queues a `SendRecovery` job, found or not; `RecoveryJob` sends the email and keeps only a SHA-256 of the code, for an
   hour. A recovered password ends every session of the root (`RootSessions`: a new `SessionStamp`, which every `/clientapi`
   JWT carries, and OpenIddict revocation for each persona).
+- **Accounts and sessions** (completion program R2, 2026-10-17):
+  - An email address is set only with the password and a 6-digit code sent to it (`/clientapi/user/email`,
+    `/email/verify`, `/email/remove`; `EmailVerification`, five tries, an hour). The request answers one sentence
+    whether or not the address is free; `EmailVerificationJob` sends nothing to an address another login verified.
+    Recovery writes only to a verified address (`IsEmailValidated`; migration `_019` kept the addresses given before).
+    `POST /clientapi/user/update` no longer changes the address (422).
+  - A changed password ends every session too, and answers a new JWT for the device that changed it.
+  - Every JWT carries its session's id (`si`, kept by renewals). `GET /clientapi/user/logout` ends that session alone
+    (`RootUser.EndedSessions`, until its tokens would expire); `POST /clientapi/user/logout/everywhere` ends them all.
+  - Passwords are PBKDF2-SHA512 at `AppConfiguration:HashingOptions:Iterations` (210,000; the option was never bound
+    before 2026-10-17), and a hash made at other iterations is made again at the next sign-in.
+  - Sign-up still says a login name is taken: uniqueness has to be told, and sign-up is reachable only while setup
+    waits or with an invitation, rate-limited.
+  - `AppConfigurationService` reads appsettings as they are now; the copy older builds saved in Mongo is not read.
 - **Deleting a root deletes everything public it had** (`RootRemoval`, from the admin route or `/clientapi/user/delete`
   with the password): its sessions end, each persona and each group it owns sends `Delete{Actor}` to followers, members
   and the accounts it follows, the personas' posts are emptied, and `/peasants/{name}`, its inbox and WebFinger answer
@@ -528,7 +542,7 @@ group www-data and reaches the private mongod; `sudo -u www-data` works too.
     backup rotates out), copies where a link can't be made. `--db-only` lists them instead.
 
   **Never in a backup** (`ServerBackup.Excluded`): `InteractionSalt` (owner rule), `Job` and `Delivery` (work in flight),
-  `EmailRecovery`, `openiddict.tokens` and `.authorizations` (sessions), `MaintenanceLock`, `ServerSetup` (a restore
+  `EmailRecovery` and `EmailVerification`, `openiddict.tokens` and `.authorizations` (sessions), `MaintenanceLock`, `ServerSetup` (a restore
   never opens setup again), and `AppConfiguration` (its SMTP password; it is made again from appsettings at boot). One
   backup or restore runs at a time
   (`MaintenanceLock`, a heartbeat document; a holder silent for 2 minutes is taken over), and the media janitor purges
@@ -771,6 +785,11 @@ tools/pasture/run.sh down                                            # removes e
   announced by the other), that alice's public post goes to the relays (and through both to Mastodon: Activity-Relay's
   forward on its FEP-8b32 proof, after the scenario makes Mastodon read alice's keys anew) and nothing less public, and
   has Mastodon leave again, so the town sees no relayed posts. 16 checks.
+- **Mailpit (1.31.4, `peers/mailpit.sh`, as `mailpit.test`):** the pasture's mail server. `appsettings.Pasture.json`
+  sends PrivaPub's mail to `pasture-mailpit:1025` (plain SMTP, any login accepted) and its recovery links to
+  `https://decepub.test`. `scenarios/accounts.sh` reads what arrived through Mailpit's API: an address set with the
+  password and its code, recovery only to a verified address and its link working once, logout ending one device,
+  a password change and "sign out everywhere" ending the others, an old hash made again at sign-in, the codes' TTL.
 - **Castopod (1.15.5, `peers/castopod.sh`):** the official image on the shared MySQL (database `castopod`, file cache,
   `CP_DISABLE_HTTPS`), its database and superadmin (admin@castopod.test) from `spark`, its REST API switched on in the
   `.env` the image rewrites at each start, `spark fediverse:broadcast` looping in the container. The podcast `@pod` is