R2 accounts are safe: email by password and code, recovery only to it, sessions that end

Completion program R2 (docs/ROADMAP.md, 2026-10-17).

- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
  /email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
  EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
  and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
  address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
  nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
  /clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
  bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
  hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
  https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).

Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

tools/pasture/sweep.sh

@@ -6,8 +6,8 @@
 # PrivaPub runs with SecureMode on, as in production, unless PRIVAPUB_ENV says otherwise; DOTNET and PASTURE_PORT reach
 # run.sh as they are. Each batch's output is kept in out/sweep-<batch>.log.
 # usage: tools/pasture/sweep.sh [A|B|C|D ...]        (default: every batch, in that order)
-#   A  gts mastodon misskey sharkey akkoma, with relay and aoderelay; scenarios: those five, threads followsync pins
-#      moves relay (relay's covers both relays)
+#   A  gts mastodon misskey sharkey akkoma, with relay, aoderelay and mailpit; scenarios: those five, threads followsync
+#      pins moves relay (relay's covers both relays) accounts (mailpit's)
 #   B  lemmy lemmy19 piefed mbin nodebb
 #   C  peertube pixelfed vernissage wordpress ghost writefreely owncast castopod funkwhale
 #   D  friendica mobilizon gancio bookwyrm smithereen mitra snac ktistec forte hubzilla
@@ -19,7 +19,7 @@ export PRIVAPUB_ENV=${PRIVAPUB_ENV:-Federation__SecureMode=true}
 
 batch_peers() {
 	case "$1" in
-	A) echo "gts mastodon misskey sharkey akkoma relay aoderelay" ;;
+	A) echo "gts mastodon misskey sharkey akkoma relay aoderelay mailpit" ;;
 	B) echo "lemmy lemmy19 piefed mbin nodebb" ;;
 	C) echo "peertube pixelfed vernissage wordpress ghost writefreely owncast castopod funkwhale" ;;
 	D) echo "friendica mobilizon gancio bookwyrm smithereen mitra snac ktistec forte hubzilla" ;;
@@ -27,7 +27,7 @@ batch_peers() {
 }
 batch_scenarios() {
 	case "$1" in
-	A) echo "gts mastodon misskey sharkey akkoma threads followsync pins moves relay" ;;
+	A) echo "gts mastodon misskey sharkey akkoma threads followsync pins moves relay accounts" ;;
 	*) batch_peers "$1" ;;
 	esac
 }