Allow users to change emails

[Will-Howard]

🧩 Summary

Some users have requested to change their account email. Currently we can do this manually, but we want to add a self-serve version.

This is blocked by #2459 (decoupling emails from everything apart from User). It also needs some scoping (best done after #2459 is finished), covering for instance:

1. How to securely verify the old and new email
2. The UI for doing this
3. Whether to roll "support multiple emails" into this issue (can make (1) easier by making the workflow add-new -> delete-old, which is lower stakes than switching)

✅ Definition of done

Users are able to change their account emails with no admin intervention

📌 Notes / Designs

No response

[Will-Howard]

Case flagged by CodeRabbit that I'm tracking here: What should we do if we get auth back from Keycloak (containing email and sub), and sub matches a user, but the user's email doesn't match auth.email.

This would effectively mean the email has been changed outside of the endorsed flow in some way. We need to decide how to handle this based on what the flow ultimately looks like.

Edit 2026-07-29: I've decided the correct behaviour here is to proceed normally in this case, i.e. require one email to sign in, and send account emails to another emails. It's an odd case to get into, and shouldn't be possible, but there's nothing inherently wrong with it from a security or logical perspective.