R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Services/RecoveryJob.cs

@@ -1,9 +1,5 @@
-using MailKit.Net.Smtp;
-
 using Microsoft.Extensions.Localization;
 
-using MimeKit;
-
 using MongoDB.Entities;
 
 using PrivaPub.Infrastructure.Jobs;
@@ -21,19 +17,19 @@ namespace PrivaPub.Services
 
 	// Sends a password recovery link. Every request queues one of these, for an account that exists or not, so the answer
 	// to the request and its timing say nothing; SMTP's slowness and failures happen here, where nobody waits on them.
-	// The code exists only in the email: the database keeps its hash, for an hour.
+	// The code exists only in the email: the database keeps its hash, for an hour. Only a verified address is written to.
 	public class RecoveryJob : IJobHandler
 	{
 		public const string Host = "recovery";
 		public static readonly TimeSpan CodeLifetime = TimeSpan.FromHours(1);
 
-		readonly AppConfigurationService _app;
+		readonly IMailer _mailer;
 		readonly IStringLocalizer<GenericRes> _localizer;
 		readonly ILogger<RecoveryJob> _logger;
 
-		public RecoveryJob(AppConfigurationService app, IStringLocalizer<GenericRes> localizer, ILogger<RecoveryJob> logger)
+		public RecoveryJob(IMailer mailer, IStringLocalizer<GenericRes> localizer, ILogger<RecoveryJob> logger)
 		{
-			_app = app;
+			_mailer = mailer;
 			_localizer = localizer;
 			_logger = logger;
 		}
@@ -51,31 +47,18 @@ namespace PrivaPub.Services
 			if (string.IsNullOrEmpty(payload?.RootUserId))
 				return JobOutcome.Done;//asked for an account that does not exist: there is nobody to write to
 			var user = await DB.Default.Find<RootUser>().MatchID(payload.RootUserId).ExecuteFirstAsync(token);
-			if (user is not { DeletedAt: null, IsBanned: false } || string.IsNullOrEmpty(user.Email))
+			if (user is not { DeletedAt: null, IsBanned: false, IsEmailValidated: true } || string.IsNullOrEmpty(user.Email))
 				return JobOutcome.Done;
 
 			var code = Convert.ToHexStringLower(RandomNumberGenerator.GetBytes(32));
 			await DB.Default.DeleteAsync<EmailRecovery>(r => r.RootUserId == user.ID);
 			await DB.Default.SaveAsync(new EmailRecovery { RootUserId = user.ID, CodeHash = Hash(code), ExpiresAt = DateTime.UtcNow + CodeLifetime }, token);
-
-			var email = _app.AppConfiguration.EmailConfiguration;
-			var message = new MimeMessage();
-			message.From.Add(new MailboxAddress("PrivaPub", email.SmtpUsername));
-			message.To.Add(MailboxAddress.Parse(user.Email));
-			message.Subject = _localizer["PrivaPub - Password recovery link"];
-			message.Body = new TextPart("plain")
-			{
-				Text = string.Format(_localizer[
-					"Hello,\n\nSomeone asked to reset the password of the PrivaPub login {0}. If it was you, open this link within an hour:\n{1}\n\nIf it was not you, ignore this email: nothing changes."],
-					user.UserName, $"{payload.Host}/password-recovery?rc={code}")
-			};
 			try
 			{
-				using var smtp = new SmtpClient();
-				await smtp.ConnectAsync(email.SmtpServer, email.SmtpPort, email.UseSSL, token);
-				await smtp.AuthenticateAsync(email.SmtpUsername, email.SmtpPassword, token);
-				await smtp.SendAsync(message, token);
-				await smtp.DisconnectAsync(quit: true, token);
+				await _mailer.Send(user.Email, _localizer["PrivaPub - Password recovery link"],
+					string.Format(_localizer[
+						"Hello,\n\nSomeone asked to reset the password of the PrivaPub login {0}. If it was you, open this link within an hour:\n{1}\n\nIf it was not you, ignore this email: nothing changes."],
+						user.UserName, $"{payload.Host}/password-recovery?rc={code}"), token);
 				return JobOutcome.Done;
 			}
 			catch (Exception ex) when (ex is not OperationCanceledException || !token.IsCancellationRequested)