feat(backend): let a customer change their own name, password and email (#111)

Two of the three already existed on the backend and had no caller. PUT /api/customers/me updated the name; POST /api/customers/change-password already demanded the current password and enforced the eight-character minimum. Neither was reachable from the frontend, which is why the gap was easy to miss — the API looked finished.

The name endpoint accepted empty values and wrote nulls, letting a customer clear fields registration refuses to let them skip. That is the same rule disagreeing with itself, so it now refuses each by name exactly as registration does.

Changing a password now ends other sessions and keeps the one making the change. Reset already deleted every session for the customer, on the reasoning that a password is changed precisely when the old one may be known to someone else — change reached the opposite conclusion for no recorded reason, and a session opened with a leaked password outlived the change meant to lock it out. The current session is spared so the change does not eject the person making it.

Changing the email address is new. It asks for the current password, because swapping the address a password reset goes to is how an account is taken over and a live session alone is not enough; that also matches what change-password already required. The address is normalised and validated, an address another account holds is refused with the same 409 as registration, and on success the row is marked unverified and any outstanding verification token superseded — one already sitting in the old inbox must not be able to verify the new address.

Two emails then go out, to different places. Verification to the new address, and a notice to the old one naming what the address was changed to. The notice is the only thing that tells a real owner their account was taken, and one that does not say where the address went is nearly useless to someone checking whether it was them. Both sends happen after the row is written, never before, so a change that failed cannot produce mail saying it succeeded.

That notice is a sixth template in #92's system, which cost a definition and a default body. The unit tests iterate every template, so its defaults were checked against its own required placeholder without writing a new test.

Verified: 199 unit and 208 integration passing. The session test signs in on a second agent, changes the password on the first, and asserts the second is refused while the first still works — the property being claimed rather than the code path being executed. One of my own assertions was wrong on the way: /me answers an unauthenticated caller with 401 and an error body, not an empty one, and the frontend is what turns that into null.

Refs #111
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/emailTemplates.ts

@@ -16,7 +16,8 @@ export type TemplateKey =
   | 'passwordReset'
   | 'favoriteSold'
   | 'favoriteWithdrawn'
-  | 'cartReminder';
+  | 'cartReminder'
+  | 'emailChanged';
 
 export interface TemplateDefinition {
   /** Shown in the admin so a card is identifiable without reading its body. */
@@ -93,6 +94,23 @@ export const TEMPLATES: Record<TemplateKey, TemplateDefinition> = {
     footer: FAVORITE_CONSENT_FOOTER
   },
 
+  emailChanged: {
+    label: 'Email address changed',
+    // Naming the new address is the point: a notice that does not say what
+    // the address was changed *to* is nearly useless to someone checking
+    // whether it was them. This is the mail that catches an account
+    // takeover, so it goes to the address being replaced.
+    required: ['newEmail'],
+    available: ['greeting', 'newEmail'],
+    defaultSubject: 'Your Redefined Designs email address was changed',
+    defaultBody:
+      '{{greeting}}\n\n' +
+      'The email address on your account was changed to **{{newEmail}}**.\n\n' +
+      'If you made this change, nothing more is needed. This message is only a\n' +
+      'record of it.\n\n' +
+      'If you did not, contact us straight away: whoever made the change can now\n' +
+      'receive password reset links for your account.'
+  },
   cartReminder: {
     label: 'Cart reminder',
     required: ['itemList', 'cartUrl'],