feat: add e-mail change with confirmation and undo

Page at /email asks for the new address and the current password (shared failure counter with the password page, five requests per hour) and mails a one-hour confirmation link to the new address. Confirming writes the address and mails the old address a 24-hour undo link; undoing restores it, ends every session of the user and notifies the Admin (ADMIN_NOTIFY_EMAIL). Link pages show on GET and apply on POST; tokens are stored only as hashes, single use, and are blanked from every log line. New table owned by profile, German text, tests; review findings logged in the plan.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

portal/templates/profile/email_undone.html

@@ -0,0 +1,11 @@
+{% extends "base.html" %}
+{% load i18n %}
+{% block title %}{% trans "E-mail change undone" %}{% endblock %}
+{% block content %}
+<h1>{% trans "E-mail change undone" %}</h1>
+<div class="notice success" role="status">
+  <p>{% trans "Your previous e-mail address is back. You were signed out on all devices." %}</p>
+</div>
+<p><strong>{% trans "Someone else may have had access to your account. Please change your password now." %}</strong></p>
+<p><a class="button primary" href="{% url 'password' %}">{% trans "Change password" %}</a></p>
+{% endblock %}