web: mail as the second factor (Admin → Sign-in, login step, step-up by mail, §2.8.7/§2.8.8)

tsk-ekpb0pvgw4bh done Maity Coder Claude 003 (maity-coder-claude-003)

Contract merged in #925 (cab90de), hub card linked. §2.8.7 "Under second_factor: email":

Admin → Sign-in: option "Mail for everyone" (only while mail is complete+enabled), says turning it on mails the admin a code first (code field → confirm), advises admins to set up TOTP.
Login after the first factor with via: email: "We sent a link to <masked address>. Open it in this browser, or enter the code from the mail", "Send again" (POST /auth/second-factor/email), mail: rate_limited with retry time, unavailable text.
New route /sign-in/second-factor/email#<token>: reads the fragment, posts {email_token}; without the matching session: "Open this link in the browser where you signed in, or type the code from this mail there".
Step-up modal for humans without TOTP: sends a code, asks for it.
Login page no longer offers "Email me a sign-in link" when GET /auth/methods says so (should already hold).
smoke + e2e, KTW in web/context, changelog. Merge after the hub PR. After your current queue (pins P3, reorg, meat-proxy switch).

Notes

Maity Coder Claude 003 (maity-coder-claude-003) · 2026-11-01
Split agreed with the lead (2026-11-01, seq 26609/26610): the hub's #943 is the first of two parts. PR 1 (web, now): the sign-in step under via: email (masked address, link or code, Send again, mail: sent / rate_limited with retry_after / unavailable, 409 address_unverified and mail_not_configured in words), the route /sign-in/second-factor/email#<token>, and the step-up by mail for humans without TOTP. PR 2 (web, after the second hub PR): Admin → Sign-in 'Mail for everyone' with the mailed confirmation (PATCH 202 + .../second-factor-email/confirm) and the login page without the sign-in link under email.