R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Services/RootSessions.cs

@@ -1,3 +1,4 @@
+using MongoDB.Driver;
 using MongoDB.Entities;
 
 using OpenIddict.Abstractions;
@@ -10,22 +11,26 @@ namespace PrivaPub.Services
 	public interface IRootSessions
 	{
 		Task Revoke(string rootId, CancellationToken token);
+		Task End(string rootId, string sessionId, CancellationToken token);
 	}
 
 	// Ends everything a root is signed in with: its /clientapi tokens, through a new SessionStamp (checked by JwtEvents),
-	// and the Mastodon API tokens and authorizations of each of its personas. Used when its password is recovered and when
-	// it is deleted.
+	// and the Mastodon API tokens and authorizations of each of its personas. Used when its password is changed or
+	// recovered, when it signs out everywhere and when it is deleted. End signs out one session only: the device that
+	// asked (its Mastodon tokens it revokes itself).
 	public class RootSessions : IRootSessions
 	{
 		readonly DbEntities _dbEntities;
 		readonly IOpenIddictTokenManager _tokens;
 		readonly IOpenIddictAuthorizationManager _authorizations;
+		readonly AuthTokenManager _authTokens;
 
-		public RootSessions(DbEntities dbEntities, IOpenIddictTokenManager tokens, IOpenIddictAuthorizationManager authorizations)
+		public RootSessions(DbEntities dbEntities, IOpenIddictTokenManager tokens, IOpenIddictAuthorizationManager authorizations, AuthTokenManager authTokens)
 		{
 			_dbEntities = dbEntities;
 			_tokens = tokens;
 			_authorizations = authorizations;
+			_authTokens = authTokens;
 		}
 
 		public async Task Revoke(string rootId, CancellationToken token)
@@ -33,6 +38,7 @@ namespace PrivaPub.Services
 			await DB.Default.Update<RootUser>().MatchID(rootId)
 				.Modify(u => u.CredentialsChangedAt, DateTime.UtcNow)
 				.Modify(u => u.SessionStamp, Guid.NewGuid().ToString("N"))
+				.Modify(u => u.EndedSessions, new List<EndedSession>())//the new stamp ends those too
 				.ExecuteAsync(token);
 			foreach (var link in await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId).ExecuteAsync(token))
 			{
@@ -40,5 +46,17 @@ namespace PrivaPub.Services
 				await _authorizations.RevokeBySubjectAsync(link.AvatarId, token);
 			}
 		}
+
+		// remembered as long as one of its tokens could still be valid; the ones that have expired are forgotten meanwhile
+		public async Task End(string rootId, string sessionId, CancellationToken token)
+		{
+			var now = DateTime.UtcNow;
+			await DB.Default.Update<RootUser>().MatchID(rootId)
+				.Modify(b => b.PullFilter(u => u.EndedSessions, s => s.Until < now))
+				.ExecuteAsync(token);
+			await DB.Default.Update<RootUser>().MatchID(rootId)
+				.Modify(b => b.Push(u => u.EndedSessions, new EndedSession { Sid = sessionId, Until = now + _authTokens.Lifetime }))
+				.ExecuteAsync(token);
+		}
 	}
 }