feat: email verification for registration, email change, and invitations

Registration now creates a pending account and sends a 6-digit code via
email; the account activates only after verification. Email changes on
the profile page follow the same flow. Group invitations send a
notification email to the invitee (without revealing their address to
the inviter) containing the invite code and hub link.

Backend: blind HMAC-SHA256 email index for uniqueness without decryption,
mail.py for localhost Postfix delivery, verification endpoints, cleanup
of expired codes and stale pending accounts, startup backfill of
email_hash for existing users.

Frontend: 3-phase register page, inline email change verification on
profile, invite-notify call with status display. All 10 locales updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 21 insertions, 6 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index b98e032..a6f77b3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -43,9 +43,18 @@ export default {
   'register.loading': 'Creating account...',
   'register.has_account': 'Already have an account?',
   'register.login_link': 'Login',
-  'register.success_title': 'Account created',
-  'register.success_msg': 'You can now log in with your credentials.',
+  'register.success_title': 'Verify your email',
+  'register.success_msg': 'A verification code has been sent to your email address. Enter it below to activate your account.',
   'register.go_login': 'Go to login',
+  'register.code_placeholder': 'Verification code',
+  'register.verify_btn': 'Verify',
+  'register.verifying': 'Verifying...',
+  'register.verified_title': 'Email verified',
+  'register.verified_msg': 'Your account is active. You can now log in.',
+  'register.resend': 'Resend code',
+  'register.resend_sent': 'A new code has been sent.',
+  'login.pending_verification': 'Your email is not yet verified. Please check your inbox for the verification code.',
+  'login.verify_link': 'Verify email',
   'register.err_mismatch': 'Passwords do not match',
   'register.err_min_len': {
     one: 'Use at least {n} character',
@@ -260,6 +269,11 @@ export default {
   'settings.email': 'Email',
   'settings.email_save': 'Save',
   'settings.email_saved': 'Email updated',
+  'settings.email_code_sent': 'A verification code has been sent to your new email address.',
+  'settings.email_code_placeholder': 'Verification code',
+  'settings.email_verify_btn': 'Verify',
+  'settings.email_verifying': 'Verifying...',
+  'settings.email_verified': 'Email address changed successfully.',
   'settings.notif_global_disable': 'Disable all notifications',
   'settings.notif_global_hint': 'When enabled, no notifications are created for any group.',
   'settings.defaults': 'Defaults',
@@ -547,10 +561,11 @@ export default {
     + 'never passes through the hub.',
   'members.pair_btn': 'Pair',
   'members.pair_success': 'This browser is now paired with the node.',
-  'members.invite_code_ready': 'Invitation code for {user} — send it to them the way '
-    + 'you normally talk. It works once, and it never passes through the hub.',
-  'members.invite_code_hint': 'They enter it the first time they open this group. '
-    + 'You do not need to be online then.',
+  'members.invite_code_ready': 'Invitation code for {user}:',
+  'members.invite_email_sent': 'An email with the code has been sent to this member.',
+  'members.invite_email_failed': 'Could not send the email — share the code manually.',
+  'members.invite_code_hint': 'You can also share this code via another channel (e.g. SMS). '
+    + 'They enter it the first time they open this group.',
   'transfers.title': 'Transfers',
   'transfers.clear': 'Clear finished',
   'transfers.cancel': 'Cancel',