feat: add e-mail change with confirmation and undo

Page at /email asks for the new address and the current password (shared failure counter with the password page, five requests per hour) and mails a one-hour confirmation link to the new address. Confirming writes the address and mails the old address a 24-hour undo link; undoing restores it, ends every session of the user and notifies the Admin (ADMIN_NOTIFY_EMAIL). Link pages show on GET and apply on POST; tokens are stored only as hashes, single use, and are blanked from every log line. New table owned by profile, German text, tests; review findings logged in the plan.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FocPJ75XPma7TcuYEMy8zm

portal/tests/test_config.py

@@ -178,3 +178,13 @@ def test_the_mail_settings_are_required(valid_env, name):
     del valid_env[name]
     with pytest.raises(ConfigError, match=name):
         load_config(valid_env)
+
+
+def test_the_admin_notice_address_is_optional_and_checked(valid_env):
+    assert load_config(valid_env).admin_notify_email == ""
+    assert load_config({**valid_env, "ADMIN_NOTIFY_EMAIL": "  "}).admin_notify_email == ""
+    good = {**valid_env, "ADMIN_NOTIFY_EMAIL": "admin@example.test"}
+    assert load_config(good).admin_notify_email == "admin@example.test"
+    with pytest.raises(ConfigError, match="ADMIN_NOTIFY_EMAIL") as info:
+        load_config({**valid_env, "ADMIN_NOTIFY_EMAIL": "not an address"})
+    assert "not an address" not in str(info.value)