feat: add e-mail change with confirmation and undo

Page at /email asks for the new address and the current password (shared failure counter with the password page, five requests per hour) and mails a one-hour confirmation link to the new address. Confirming writes the address and mails the old address a 24-hour undo link; undoing restores it, ends every session of the user and notifies the Admin (ADMIN_NOTIFY_EMAIL). Link pages show on GET and apply on POST; tokens are stored only as hashes, single use, and are blanked from every log line. New table owned by profile, German text, tests; review findings logged in the plan.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

portal/config/middleware.py

@@ -7,7 +7,7 @@ import re
 import time
 import uuid
 
-from .logging import request_id_var
+from .logging import redact, request_id_var
 
 logger = logging.getLogger("portal.request")
 
@@ -48,7 +48,7 @@ class RequestIdMiddleware:
                 extra={
                     "request_id": request_id,
                     "method": request.method,
-                    "path": request.path,
+                    "path": redact(request.path),
                     "status": status,
                     "duration_ms": round((time.monotonic() - started) * 1000, 1),
                 },