Email channel and self-service credentials (first 0.4 batch)
- Resend email channel and OTP infrastructure (hashed OTP storage, rate limiting on two dimensions, lockout after failures).
- Forgot password (email OTP reset) and logged-in self-service password change; anti-enumeration design aligned with the login flow.
- Admin actions such as password reset, freeze, and role change trigger immediate token revocation.