Request Password Setup

Mail a set-a-password link to a signed-in OAuth user's own address.

Why this is not "just let them set one": there is no current password to check, so a bare session would be the only thing standing between a stolen token and permanent account takeover. Today that token dies in 24 hours; minting a password from it would make the takeover permanent. The mailbox is the second proof, and it is the same proof the provider used to vouch for them in the first place.

Sending it to current_user.email rather than an address in the body is the point — the caller does not get to choose where the link goes.

(When Sign in with Apple goes live this needs a second path: Apple's private relay addresses, already detected as is_private_email in oauth_routes, are mailboxes many people never read. The convention there is a fresh OAuth bounce as the re-authentication instead of an email.)