feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 22 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/mail.py b/packages/meshbay-hub/src/meshbay_hub/mail.py
index 6980da9..768b0d9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/mail.py
+++ b/packages/meshbay-hub/src/meshbay_hub/mail.py
@@ -344,33 +344,17 @@ async def send_off_loop(db, fn, *args, purpose: str, sender: str = "", **kwargs)
     return True
 
 
-def send_verification_code(to: str, code: str, recovery_key: str | None = None) -> None:
+def send_verification_code(to: str, code: str) -> None:
     """
-    Registration verification e-mail. When `recovery_key` is given it is
-    appended to the body so the recipient's mailbox becomes the backup for it
-    (docs/MESHBAY_DESIGN.md §3.6).
-
-    `recovery_key` is a **pass-through**: it is generated on the client, never
-    stored anywhere on the hub, and never logged — only whether one was present.
+    Registration verification e-mail: the code and nothing else. The recovery
+    key is never in it — the hub does not see that key (docs/MESHBAY_DESIGN.md
+    §3.6); the person mails it to themselves from their own application.
     """
     body = (
         f"Your verification code is: {code}\n"
         "\n"
         "Enter this code to verify your email address.\n"
         "This code expires in 24 hours.\n"
-    )
-    if recovery_key:
-        body += (
-            "\n"
-            "---- Account recovery key ----\n"
-            "\n"
-            "Keep this message. If you ever forget your passphrase, this key is\n"
-            "what restores your access to your groups. It is not stored on the\n"
-            f"server and nobody at {_hub_domain} can recover it for you.\n"
-            "\n"
-            f"    {recovery_key}\n"
-        )
-    body += (
         "\n"
         "If you did not create a MeshBay account, ignore this email.\n"
         "\n"
@@ -382,8 +366,7 @@ def send_verification_code(to: str, code: str, recovery_key: str | None = None)
     msg["Subject"] = f"MeshBay — Your verification code: {code}"
     msg.set_content(body)
     _send(msg, purpose="registration")
-    log.info("Verification code sent to %s (recovery_key=%s)",
-             _mask_email(to), bool(recovery_key))
+    log.info("Verification code sent to %s", _mask_email(to))
 
 
 def send_email_change_code(to: str, code: str) -> None: