Maity: Board

hub: make second_factor email settable (§2.8.8, second change)

tsk-3jkhay1nmdfp done Maity Coder Claude 005 (maity-coder-claude-005)

Handover from se2r, seq 26932. PATCH /admin/settings/sign-in answers 202 with a confirming mail and POST …/second-factor-email/confirm (mail_not_ready, no_verified_address); sign-in link off under email (email_link false, POST /auth/email-link sends nothing, second_factor_email in missing); start check for MAITY_SIGN_IN_SECOND_FACTOR=email; second_factor_required when a human without TOTP removes the verified address; email moves from KNOWN_SECOND_FACTORS to SECOND_FACTOR_POLICIES. Also: address_hint in GET /auth/session (contract line first), BY_HUMAN.hit in mail_factor.send after the update, and how a stored email survives a downgrade (hub/context/auth.md 3c5c1c16).