R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Services/EmailVerificationJob.cs

@@ -0,0 +1,73 @@
+using Microsoft.Extensions.Localization;
+
+using MongoDB.Entities;
+
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.User;
+using PrivaPub.Resources;
+
+using System.Security.Cryptography;
+using System.Text.Json;
+
+namespace PrivaPub.Services
+{
+	public sealed record EmailVerificationPayload(string VerificationId);
+
+	// Sends the code that proves a login owns the address it asked for. The code exists only in the email; the row keeps its
+	// hash. An address another login has verified meanwhile gets nothing, so the answer to the request never told whether
+	// the address was taken, and no stranger's inbox receives a code it didn't ask for twice.
+	public class EmailVerificationJob : IJobHandler
+	{
+		public const string Host = "email";
+
+		readonly IMailer _mailer;
+		readonly IStringLocalizer<GenericRes> _localizer;
+		readonly ILogger<EmailVerificationJob> _logger;
+
+		public EmailVerificationJob(IMailer mailer, IStringLocalizer<GenericRes> localizer, ILogger<EmailVerificationJob> logger)
+		{
+			_mailer = mailer;
+			_localizer = localizer;
+			_logger = logger;
+		}
+
+		public JobKind Kind => JobKind.SendEmailVerification;
+		public int Concurrency => 1;
+		public int MaxAttempts => 3;
+		public int PerHostLimit => 1;
+
+		public static string NewCode() => RandomNumberGenerator.GetInt32(0, 1_000_000).ToString("D6");
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var payload = JsonSerializer.Deserialize<EmailVerificationPayload>(job.Payload);
+			var now = DateTime.UtcNow;
+			var pending = string.IsNullOrEmpty(payload?.VerificationId) ? default
+				: await DB.Default.Find<EmailVerification>().Match(v => v.ID == payload.VerificationId && v.ExpiresAt > now).ExecuteFirstAsync(token);
+			if (pending == default)
+				return JobOutcome.Done;
+			var user = await DB.Default.Find<RootUser>().MatchID(pending.RootUserId).ExecuteFirstAsync(token);
+			if (user is not { DeletedAt: null, IsBanned: false })
+				return JobOutcome.Done;
+			if (await DB.Default.Find<RootUser>().Match(u => u.Email == pending.Email && u.IsEmailValidated && u.ID != user.ID && u.DeletedAt == null).ExecuteAnyAsync(token))
+				return JobOutcome.Done;
+
+			var code = NewCode();
+			await DB.Default.Update<EmailVerification>().MatchID(pending.ID).Modify(v => v.CodeHash, RecoveryJob.Hash(code)).ExecuteAsync(token);
+			try
+			{
+				await _mailer.Send(pending.Email, _localizer["PrivaPub - Confirm your email address"],
+					string.Format(_localizer[
+						"Hello,\n\nThe PrivaPub login {0} asked to use this address. If it was you, enter this code within an hour:\n\n{1}\n\nIf it was not you, ignore this email: the address is not used."],
+						user.UserName, code), token);
+				return JobOutcome.Done;
+			}
+			catch (Exception ex) when (ex is not OperationCanceledException || !token.IsCancellationRequested)
+			{
+				_logger.LogWarning(ex, "The verification email could not be sent");
+				return JobOutcome.Retry("smtp");
+			}
+		}
+	}
+}