Recover By Device

Recover account via username + latest device_id + new email (Method 2).

For migrated users whose users.email is NULL. If the username exists, has no bound email, and the device_id matches the latest entry in user_logins (by created_at OR updated_at), a verification code is sent to new_email.

• Username not found: explicit 404 (registration page already reveals username existence)
• User already has email bound: 409 + security warning to real owner
• Device mismatch: 400 with a generic "info invalid" error (anti-brute-force is handled by the per-username lockout counter; silent success only left legitimate users waiting for an email that never arrives)
• New email taken: 409 (same enumeration exposure as /register)