Change Email

Start an email change. We hand the new address to Supabase with email_confirm: false so Supabase fires its re-verification flow — we never auto-confirm.

The app users.email column reconciles on the next token verification: _ensure_user in app/auth.py rewrites the app row's email whenever the verified Supabase token's email differs (the elif user.email != email branch). So once the user confirms via the link and their next token carries the new email, the app row follows automatically — no extra sync needed here.