feat: email verification for registration, email change, and invitations

Registration now creates a pending account and sends a 6-digit code via
email; the account activates only after verification. Email changes on
the profile page follow the same flow. Group invitations send a
notification email to the invitee (without revealing their address to
the inviter) containing the invite code and hub link.

Backend: blind HMAC-SHA256 email index for uniqueness without decryption,
mail.py for localhost Postfix delivery, verification endpoints, cleanup
of expired codes and stale pending accounts, startup backfill of
email_hash for existing users.

Frontend: 3-phase register page, inline email change verification on
profile, invite-notify call with status display. All 10 locales updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 31 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index dbabfc2..e6c7d33 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -46,6 +46,7 @@ class User(Base):
     # wrapped the group key for whatever it returned, which is finding H3; since
     # the node does the wrapping, nothing reads a key from this directory. Keys
     # are generated per node and pinned there (meshbay_node/roster.py).
+    email_hash:  Mapped[str | None] = mapped_column(String(64), nullable=True)  # HMAC blind index
     pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True)  # node daemon key
     hub_id:           Mapped[str] = mapped_column(String(128), nullable=False)
     role:             Mapped[str] = mapped_column(String(16), default="user")  # user|moderator|admin
@@ -60,6 +61,7 @@ class User(Base):
     __table_args__ = (
         Index("ix_users_username", "username"),
         Index("ix_users_email", "email"),
+        Index("ix_users_email_hash", "email_hash", unique=True),
     )
 
 
@@ -354,3 +356,32 @@ class IPLog(Base):
         Index("ix_ip_logs_timestamp", "timestamp"),
         Index("ix_ip_logs_ip", "ip_address"),
     )
+
+
+class EmailVerification(Base):
+    """
+    One-time codes for email verification.
+
+    Purposes:
+      - registration: confirm the address at sign-up (account stays pending until verified)
+      - email_change: confirm a new address before it replaces the old one
+      - invitation:   notify an invitee with the group invite code
+    """
+    __tablename__ = "email_verifications"
+
+    id:              Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    email_hash:      Mapped[str] = mapped_column(String(64), nullable=False)
+    email_encrypted: Mapped[str | None] = mapped_column(String(256))
+    code:            Mapped[str] = mapped_column(String(16), nullable=False)
+    purpose:         Mapped[str] = mapped_column(String(16), nullable=False)
+    user_id:         Mapped[str | None] = mapped_column(ForeignKey("users.id"))
+    group_id:        Mapped[str | None] = mapped_column(ForeignKey("groups.id"))
+    created_at:      Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+    expires_at:      Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    verified_at:     Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    attempts:        Mapped[int] = mapped_column(Integer, default=0)
+
+    __table_args__ = (
+        Index("ix_email_verif_hash", "email_hash"),
+        Index("ix_email_verif_user", "user_id"),
+    )