feat: email verification for registration, email change, and invitations

Registration now creates a pending account and sends a 6-digit code via
email; the account activates only after verification. Email changes on
the profile page follow the same flow. Group invitations send a
notification email to the invitee (without revealing their address to
the inviter) containing the invite code and hub link.

Backend: blind HMAC-SHA256 email index for uniqueness without decryption,
mail.py for localhost Postfix delivery, verification endpoints, cleanup
of expired codes and stale pending accounts, startup backfill of
email_hash for existing users.

Frontend: 3-phase register page, inline email change verification on
profile, invite-notify call with status display. All 10 locales updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 53 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py
new file mode 100644
index 0000000..20ba29d
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d4e5f6a7b8c9_add_email_verification.py
@@ -0,0 +1,53 @@
+"""add_email_verification
+
+Add email_hash blind index to users (for uniqueness without decryption),
+and the email_verifications table for registration, email change, and
+invitation codes.
+
+Revision ID: d4e5f6a7b8c9
+Revises: c3d4e5f6a7b8
+Create Date: 2026-08-31 14:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = 'd4e5f6a7b8c9'
+down_revision: Union[str, Sequence[str], None] = 'c3d4e5f6a7b8'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('users',
+        sa.Column('email_hash', sa.String(64), nullable=True))
+    op.create_index('ix_users_email_hash', 'users', ['email_hash'], unique=True)
+
+    op.create_table('email_verifications',
+        sa.Column('id', sa.String(36), nullable=False),
+        sa.Column('email_hash', sa.String(64), nullable=False),
+        sa.Column('email_encrypted', sa.String(256), nullable=True),
+        sa.Column('code', sa.String(16), nullable=False),
+        sa.Column('purpose', sa.String(16), nullable=False),
+        sa.Column('user_id', sa.String(36), sa.ForeignKey('users.id'), nullable=True),
+        sa.Column('group_id', sa.String(36), sa.ForeignKey('groups.id'), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True),
+                  server_default=sa.text("(now() at time zone 'utc')")),
+        sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+        sa.Column('verified_at', sa.DateTime(timezone=True), nullable=True),
+        sa.Column('attempts', sa.Integer, server_default='0'),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    op.create_index('ix_email_verif_hash', 'email_verifications', ['email_hash'])
+    op.create_index('ix_email_verif_user', 'email_verifications', ['user_id'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_email_verif_user')
+    op.drop_index('ix_email_verif_hash')
+    op.drop_table('email_verifications')
+    op.drop_index('ix_users_email_hash', table_name='users')
+    op.drop_column('users', 'email_hash')