Change email

Read the sign-in decision record in docs/decisions. Add changing the address to settings. On a hosted provider, use its own flow and update the local identity from its answer or webhook. For own passwords, ask for the password or a fresh sign-in, send a single-use short-lived link to the new address with the existing token mechanism, keep the old address active until the link is used and tell the old address straight away, with a way to report that it was not them. End the user's other sessions after the change. Never reveal that an address is taken: show the same message and write to that address instead. Test an expired link, a taken address and a change that is never finished.