Email verification, password reset, email change

Three parallel flows share one mechanism: request-verification / confirm-verification, request-password-reset / confirm-password-reset, and request-email-change (authenticated) / confirm-email-change. Each request-* call always answers 204 regardless of whether the address exists, so the endpoint can’t be used to enumerate accounts. Each mints a one-time, single-use action token (a stateless JWT under a dedicated type, burned the same way a session token is — via tokenKey rotation). The bundled mailer falls back to a Log backend that writes the email to tracing instead of delivering it, so every flow above is exercisable with zero external mail setup in development.

Each flow’s email is customizable two ways — see Email → Templates for the exact priority order: the collection’s own authOptions.*Template field (the original mechanism), or the newer, editable _emailTemplates row (auth.verification, auth.passwordReset, auth.emailChange).