feat: email verification for registration, email change, and invitations

Registration now creates a pending account and sends a 6-digit code via
email; the account activates only after verification. Email changes on
the profile page follow the same flow. Group invitations send a
notification email to the invitee (without revealing their address to
the inviter) containing the invite code and hub link.

Backend: blind HMAC-SHA256 email index for uniqueness without decryption,
mail.py for localhost Postfix delivery, verification endpoints, cleanup
of expired codes and stale pending accounts, startup backfill of
email_hash for existing users.

Frontend: 3-phase register page, inline email change verification on
profile, invite-notify call with status display. All 10 locales updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/conftest.py b/packages/meshbay-hub/tests/conftest.py
index 4593f86..bf96e3d 100644
--- a/packages/meshbay-hub/tests/conftest.py
+++ b/packages/meshbay-hub/tests/conftest.py
@@ -4,6 +4,7 @@ import os
 import pytest
 import pytest_asyncio
 from pathlib import Path
+from unittest.mock import AsyncMock
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives import serialization
 
@@ -84,3 +85,14 @@ async def db_session(app):
     from meshbay_hub.db.engine import get_session_factory
     async with get_session_factory()() as session:
         yield session
+
+
+@pytest.fixture(autouse=True)
+def _skip_email_verification(monkeypatch):
+    """Skip email verification in tests — users are active immediately."""
+    async def _noop(db, user, email, eh):
+        pass
+
+    monkeypatch.setattr(
+        "meshbay_hub.api.users._create_and_send_verification", _noop)
+    monkeypatch.setattr("meshbay_hub.mail._send", lambda msg: True)