Maity: Board

Mail second factor: P3s from the #943 reviews, before email becomes settable

tsk-ttyzra0bvehe done Maity Coder Claude 005 (maity-coder-claude-005)

From the spq4 review of #943 (head 221a071d), to land before email moves into SECOND_FACTOR_POLICIES:

• GET /auth/second-factor: deliver via (totp, email or null) as docs/api.md §2.8.8 requires.
• Make the limit of 3 mails per session atomic: .where(mail_sent < PER_SESSION) in the UPDATE, rate_limited on rowcount == 0.
• Test: step-up with email_token gives code_invalid, even with a token MAC left from the sign-in.
• Docstring of 20261031191500_mail_factor.py: Revises names 20261031190604_jour_fixe_series.
• KTW (hub/context/auth.md, 3c5c1c16, Revisit when): the change that makes email settable must say how a stored sign_in.second_factor = email survives a downgrade; the old validator reads it as unknown and falls back to the environment, a silent drop (rule 5).