Account lifecycle & security completeness #71

Where this stands

:feature:auth and :feature:profile already cover register, forgot/reset password, verify
email, send-verification-email, active sessions (with "This device" labelling and revoke),
connected-account listing, change-email request, account deletion, blocks/mutes and reports.

The remaining gaps are the tail of the email-change flow, the account-status surfaces the web
explains at /help/account, and the deliberate absence of billing.

Unused API surface

• POST /api/auth/verify-email-change
• POST /api/auth/undo-email-change
• POST /api/auth/login / POST /api/auth/logout (the app uses sync-token; confirm no
  behaviour is lost)
• GET /api/auth/accounts, POST /api/auth/switch, POST /api/auth/remove-account,
  POST /api/auth/{provider}/link — previously confirmed cookie-session-only

Filed from the parity review of feature/parity-wip @ 14d7795 against interlinedlist.com (OpenAPI /api/openapi.json, 233 paths) and the public help centre.