feat: add secure self-service email change workflow

[jmgasper]

Summary

• Add self-or-admin endpoints to send and verify an OTP at the current primary email.
• Send a one-time validation link only to the proposed new email and defer all database changes until that link is validated.
• Reuse the existing primary-email update service for the final identity/member database update and user event.
• Bind each step to the verified current address, cap OTP attempts, rate-limit resends, and keep OTP/proof/pending state short-lived in shared cache.
• Document the new endpoints and environment settings.

Platform dependency

• feat: add self-service account email changes platform-ui#2203

Testing

• pnpm lint
• pnpm build
• pnpm exec jest src/api/user/email-change.service.spec.ts --runInBand (4 tests)

Notes

• This repository uses develop as its integration branch; there is no dev branch.