R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Backup/ServerBackup.cs

@@ -35,6 +35,7 @@ namespace PrivaPub.Infrastructure.Backup
 			["Job"] = "work in flight: deliveries and inbox processing belong to the moment",
 			["Delivery"] = "work in flight, from before jobs",
 			["EmailRecovery"] = "recovery codes live an hour",
+			["EmailVerification"] = "email verification codes live an hour",
 			["openiddict.tokens"] = "sessions: a restore ends every one",
 			["openiddict.authorizations"] = "sessions: a restore ends every one",
 			[nameof(MaintenanceLock)] = "who is backing up or restoring now",

PrivaPub/Infrastructure/Data/Indexes.cs

@@ -185,6 +185,11 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<InteractionEvent>(token, e => e.Host, e => e.At);
 			await DB.Default.Index<InteractionSalt>().Key(s => s.Day, KeyType.Ascending).Option(o => o.Unique = true).CreateAsync(token);
 			await DB.Default.Index<InteractionSalt>().Key(s => s.ExpiresAt, KeyType.Ascending).Option(o => o.ExpireAfter = TimeSpan.Zero).CreateAsync(token);
+			// codes live an hour: the TTL monitor removes what expired, nothing else ever has to
+			await DB.Default.Index<EmailRecovery>().Key(r => r.ExpiresAt, KeyType.Ascending).Option(o => o.ExpireAfter = TimeSpan.Zero).CreateAsync(token);
+			await Plain<EmailRecovery>(token, r => r.CodeHash);
+			await DB.Default.Index<EmailVerification>().Key(v => v.ExpiresAt, KeyType.Ascending).Option(o => o.ExpireAfter = TimeSpan.Zero).CreateAsync(token);
+			await Plain<EmailVerification>(token, v => v.RootUserId);
 			await DB.Default.Index<InstanceDay>().Key(d => d.Day, KeyType.Ascending).Key(d => d.Host, KeyType.Ascending).Option(o => o.Unique = true).CreateAsync(token);
 			await Plain<InstanceDay>(token, d => d.Host, d => d.Day);
 			await DB.Default.Index<ServerDay>().Key(d => d.Day, KeyType.Ascending).Option(o => o.Unique = true).CreateAsync(token);

PrivaPub/Infrastructure/Data/Migrations/_019_addresses_given_before_verification_are_kept.cs

@@ -0,0 +1,19 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.User;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	// recovery writes only to a verified address since 2026-10-17; an address a login gave before verification existed is
+	// taken as verified, or that login would silently lose its way back
+	public class _019_addresses_given_before_verification_are_kept : IMigration
+	{
+		public async Task UpgradeAsync()
+		{
+			await DB.Default.Update<RootUser>()
+				.Match(u => u.Email != null && u.Email != "" && u.DeletedAt == null && !u.IsEmailValidated)
+				.Modify(u => u.IsEmailValidated, true)
+				.ExecuteAsync();
+		}
+	}
+}