Maity: Board

auth: sign in with email and password; after 3 wrong passwords a sign-in link instead of a lock; no admin without email

tsk-ke4dfkwec6vs open

Oliver's decision 2026-11-04 (req-wnr43669t3q4 and his chat):

• Password sign-in takes the email address plus the password, not the handle ("es ist öffentlich und wir lassen es weg").
• After 3 wrong passwords, the account is not locked. The person is asked for their email address and gets a sign-in link (the existing email-link sign-in, §2.6).
• Every account with admin rights has a confirmed email address; an admin without email is not possible.
• The second factor (TOTP, §2.8) stays as it is.
• The counter for wrong second-factor codes is checked and raised in one step.

Order: contract first (§2.6, §2.7, §2.8.6), then Hub, then Web and CLI. Comes after tsk-0baaez2895sb and #1320. Details in a DM from the lead. Plan to the lead before the first push.