R2 accounts in decePub: forgotten password, email by code, sessions, the theme kept with the login

Completion program R2, with PrivaPub's routes of the same release.

- Pages/PasswordRecovery.razor (/password-recovery): asks for a login or an address and shows the server's one
  sentence; with ?rc= it takes the code out of the address bar at once, checks it and sets a new password. Login links
  there ("Forgot your password?").
- Settings, the login: its email address with a verified badge, changed with the password and the code emailed to it
  (DOtp), removed with the password; "Sign out everywhere" (every device and persona, asked first).
- A password change takes the new JWT PrivaPub answers and exchanges the persona's token again, since every persona
  token ended with it.
- The theme kept with the login (PageSettings.SyncWithLogin, Settings > General): taken at sign-in and start-up once a
  client saved it, saved 1.5 s after a change here, never posted back when nothing changed, never the language.
- Login, Setup and Join start the session through CascadingState.SignedIn, which takes the login's theme.
- 38 keys in both resx files; CLAUDE.md follows.

Verified: dotnet build decePubClient.csproj -c Release (0 errors, no new warnings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

LayerComponents/CascadingState.razor

@@ -3,7 +3,8 @@
 @* The app-wide state, cascaded to every page and component (LocalizableComponentBase.CascadingState): the saved
    PublicCacheData with its theme settings, the session (the root's personas and the Mastodon account of the one the
    client acts as), and whether the app is online, polled every 10 seconds. A change re-renders every subscriber; pages
-   compare PersonaId to reload what belongs to the persona. *@
+   compare PersonaId to reload what belongs to the persona. With PageSettings.SyncWithLogin the theme is the login's:
+   taken at sign-in and at start-up, saved there a moment after it changes here. *@
 <CascadingValue IsFixed=false Value=this>
 	@ChildContent
 </CascadingValue>
@@ -11,6 +12,8 @@
 @code {
 	/// <summary>How often the JWT's expiry is checked; AuthService renews it two days before.</summary>
 	static readonly TimeSpan RefreshInterval = TimeSpan.FromHours(1);
+	/// <summary>How long a change of the page settings waits before it is saved as the login's: a slider sends many.</summary>
+	static readonly TimeSpan SettingsSaveDelay = TimeSpan.FromMilliseconds(1500);
 
 	[Parameter] public RenderFragment ChildContent { get; set; }
 	[Inject] ILocalStorageService Storage { get; set; }
@@ -42,6 +45,11 @@
 	PeriodicTimer onlineTimer;
 	PeriodicTimer refreshTimer;
 	readonly CancellationTokenSource disposeCancellation = new();
+	/// <summary>What the login is known to keep, as LoginFingerprint reads it (null when unknown), so settings that already
+	/// match it, the login's own just taken among them, aren't saved again.</summary>
+	(string, short, short, bool, bool, bool, bool)? loginSettings;
+	/// <summary>The one save of the page settings waiting for SettingsSaveDelay to pass.</summary>
+	CancellationTokenSource pendingSettingsSave;
 
 	protected override async Task OnInitializedAsync()
 	{
@@ -59,6 +67,8 @@
 			_ = PollOnline(cancellationToken);
 
 			await LoadSession(cancellationToken);
+			if (IsSignedIn && IsOnline && PublicCacheData.PageSettings.SyncWithLogin)
+				await KeepThemeWithLogin(await AuthService.Settings(cancellationToken), cancellationToken);
 			refreshTimer = new(RefreshInterval);
 			_ = KeepSessionFresh(cancellationToken);
 		}
@@ -77,13 +87,98 @@
 		StateHasChanged();
 	}
 
-	/// <summary>Changes the page settings, then saves and applies them like UpdatePublicCache.</summary>
+	/// <summary>Changes the page settings, then saves and applies them like UpdatePublicCache, and saves them as the
+	/// login's a moment later (SaveSettingsSoon).</summary>
 	public ValueTask UpdatePageSettings(Action<PageSettings> change, CancellationToken cancellationToken = default)
 	{
 		change(PublicCacheData.PageSettings);
+		SaveSettingsSoon();
 		return UpdatePublicCache(PublicCacheData, cancellationToken);
 	}
 
+	/// <summary>
+	/// Reads the session a login, a setup or an invitation has just started (AuthService keeps its JWT, which carries the
+	/// login's settings), then keeps the theme with the login's (KeepThemeWithLogin).
+	/// </summary>
+	public async Task SignedIn(JwtUser jwtUser, CancellationToken cancellationToken = default)
+	{
+		loginSettings = null;
+		await LoadSession(cancellationToken);
+		await KeepThemeWithLogin(jwtUser?.UserSettings, cancellationToken);
+	}
+
+	/// <summary>
+	/// When this device keeps its theme with the login: takes the login's theme (never its language, which would reload the
+	/// app) once a client saved one, or gives the login this device's while none did. Unknown settings change nothing.
+	/// </summary>
+	async Task KeepThemeWithLogin(ViewUserSettings settings, CancellationToken cancellationToken)
+	{
+		if (settings is null || !IsSignedIn || !PublicCacheData.PageSettings.SyncWithLogin)
+			return;
+
+		if (settings.SavedAt is null)
+		{
+			SaveSettingsSoon();
+			return;
+		}
+
+		PublicCacheData.PageSettings.TakeLoginTheme(settings);
+		// as the login keeps them now, so taking them isn't followed by saving them back
+		loginSettings = LoginFingerprint(PublicCacheData.PageSettings.ToLoginSettings());
+		await UpdatePublicCache(PublicCacheData, cancellationToken);
+	}
+
+	/// <summary>
+	/// Saves the page settings as the login's once SettingsSaveDelay passed without another change: signed in, with
+	/// SyncWithLogin, and only when they differ from what the login is known to keep. One save waits at a time; a failure
+	/// is logged (AuthService.SaveSettings), never shown.
+	/// </summary>
+	void SaveSettingsSoon()
+	{
+		CancelSettingsSave();
+		var settings = PublicCacheData.PageSettings;
+		if (!IsSignedIn || !settings.SyncWithLogin || LoginFingerprint(settings.ToLoginSettings()) == loginSettings)
+			return;
+
+		pendingSettingsSave = new();
+		_ = SaveSettingsLater(pendingSettingsSave.Token);
+	}
+
+	async Task SaveSettingsLater(CancellationToken cancellationToken)
+	{
+		try
+		{
+			await Task.Delay(SettingsSaveDelay, cancellationToken);
+		}
+		catch (OperationCanceledException)
+		{
+			return;
+		}
+
+		if (!IsSignedIn)
+			return;
+
+		var settings = PublicCacheData.PageSettings.ToLoginSettings();
+		var result = await AuthService.SaveSettings(settings, cancellationToken);
+		if (result.IsInvalid)
+			return;
+
+		loginSettings = LoginFingerprint(settings);
+	}
+
+	void CancelSettingsSave()
+	{
+		var pending = pendingSettingsSave;
+		pendingSettingsSave = null;
+		pending?.Cancel();
+		pending?.Dispose();
+	}
+
+	/// <summary>What of the login's settings this client reads and writes: not the icons' hue, nor when they were saved.</summary>
+	static (string, short, short, bool, bool, bool, bool) LoginFingerprint(ViewUserSettings settings) =>
+		(settings.LanguageCode, settings.LightThemeIndexColour, settings.DarkThemeIndexColour, settings.PreferSystemTheming,
+			settings.ThemeIsDarkMode, settings.ThemeIsLightGray, settings.ThemeIsDarkGray);
+
 	/// <summary>
 	/// Reads the session after start-up or a login: renews the JWT when it is about to expire, lists the personas and
 	/// acts as the last one used (the first one otherwise).
@@ -161,6 +256,7 @@
 	/// <summary>Revokes the persona tokens, ends the session and forgets the local data.</summary>
 	public async Task SignOut(CancellationToken cancellationToken = default)
 	{
+		CancelSettingsSave();
 		await AuthService.Logout(cancellationToken);
 		ClearSession();
 		StateHasChanged();
@@ -168,6 +264,8 @@
 
 	void ClearSession()
 	{
+		CancelSettingsSave();
+		loginSettings = null;
 		IsSignedIn = false;
 		RootUserName = null;
 		Personas = [];
@@ -236,6 +334,7 @@
 	{
 		await disposeCancellation.CancelAsync();
 		disposeCancellation.Dispose();
+		CancelSettingsSave();
 		onlineTimer?.Dispose();
 		refreshTimer?.Dispose();
 		cascadingStateReference?.Dispose();