feat: add e-mail change with confirmation and undo

Page at /email asks for the new address and the current password (shared failure counter with the password page, five requests per hour) and mails a one-hour confirmation link to the new address. Confirming writes the address and mails the old address a 24-hour undo link; undoing restores it, ends every session of the user and notifies the Admin (ADMIN_NOTIFY_EMAIL). Link pages show on GET and apply on POST; tokens are stored only as hashes, single use, and are blanked from every log line. New table owned by profile, German text, tests; review findings logged in the plan.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

portal/templates/profile/email_confirm.html

@@ -0,0 +1,20 @@
+{% extends "base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Confirm new e-mail address" %}{% endblock %}
+{% block content %}
+<h1>{% trans "Confirm new e-mail address" %}</h1>
+<p class="lead">{% trans "The e-mail address of your account will change. Nothing changes until you press the button." %}</p>
+<dl class="card details">
+  <dt>{% trans "Current e-mail address" %}</dt>
+  <dd>{% if change.old_address %}{{ change.old_address }}{% else %}&ndash;{% endif %}</dd>
+  <dt>{% trans "New e-mail address" %}</dt>
+  <dd>{{ change.new_address }}</dd>
+</dl>
+{% if change.old_address %}<p>{% trans "A notice with a way to undo the change is sent to the current address." %}</p>{% endif %}
+<form method="post" action="{{ request.path }}" class="card" data-busy-on-submit>
+  {% csrf_token %}
+  <p class="actions">
+    <button type="submit" class="primary"><span class="spinner" aria-hidden="true"></span>{% trans "Confirm change" %}</button>
+  </p>
+</form>
+{% endblock %}