Email confirmation, change email/password, show/hide passwords

- Sign-up emails a confirmation link (24h); unconfirmed accounts see a
  banner on the web with "send it again", and status in Settings.
- Change email (needs the password): the new address gets a confirmation
  link and only replaces the old one once clicked; the old address gets a
  heads-up with a reset-password link. Pending changes can be cancelled.
- Change password (needs the current one): signs out other sessions.
- Password fields have Show/Hide on web and mobile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/client.ts

@@ -10,7 +10,16 @@ import type {
   UserSummaryDTO,
 } from './dto';
 import type { DeviceDTO } from './devices';
-import type { LoginInput, RegisterInput, ReportReason, ResetPasswordInput, SetFeaturedInput, UpdateMeInput } from './schemas';
+import type {
+  ChangeEmailInput,
+  ChangePasswordInput,
+  LoginInput,
+  RegisterInput,
+  ReportReason,
+  ResetPasswordInput,
+  SetFeaturedInput,
+  UpdateMeInput,
+} from './schemas';
 
 export class ApiError extends Error {
   constructor(
@@ -72,6 +81,13 @@ export function createApiClient({ baseUrl, getToken, credentials }: ApiClientOpt
     /** Always succeeds, so it doesn't reveal which emails have accounts. */
     forgotPassword: (email: string) => request<{ ok: true }>('/auth/forgot-password', { body: { email } }),
     resetPassword: (input: ResetPasswordInput) => request<AuthResponse>('/auth/reset-password', { body: input }),
+    verifyEmail: (token: string) => request<{ ok: true; email: string }>('/auth/verify-email', { body: { token } }),
+    resendVerification: () => request<{ ok: true }>('/me/verify-email/resend', { body: {} }),
+    /** Signs out your other devices. */
+    changePassword: (input: ChangePasswordInput) => request<{ ok: true }>('/me/password', { body: input }),
+    /** Sends a confirmation link to the new address; the email changes once it's clicked. */
+    changeEmail: (input: ChangeEmailInput) => request<MeDTO>('/me/email', { body: input }),
+    cancelEmailChange: () => request<MeDTO>('/me/email/pending', { method: 'DELETE' }),
     logout: () => request('/auth/logout', { method: 'POST', body: {} }),
 
     me: () => request<MeDTO>('/me'),