Set Console passwords by email code

[JacobStephens2]

Summary

email → identical HTTP answer, independent of delivery
  allowed + within send limits → hashed six-digit code → Resend
code + new password → verified account → signed in
  consume code; end previous sessions; write Console log

One Set your password flow creates a Console account or resets its password. Codes last 15 minutes with 5 tries; durable limits allow one send a minute and 10 per rolling day. Without a Resend key, the page explains thirdshift console password.

Closes #822

Evidence

• Before: the reviewer's exact delayed-Resend regression failed: unknown address 88 ms, allowed address 2.93 s.
  After: the same retained regression passes after separating the answer from delivery.
• All seven email-code HTTP tests pass against the Resend stand-in: account creation/reset, key precedence, hash-only storage, verification, session revocation, replay, expiry, attempts, both send limits, CSRF, disabled flow and transport failure.
• Controlled-clock account tests cover exact expiry/attempt/send boundaries and persistence.
• Validation: cargo clippy --all-targets -- -D warnings, cargo fmt --check; all 32 Console HTTP tests and 25 Console browser tests, plus the account browser test rerun after the page-rendering refactor.
• The full cargo test run stopped at the existing process_tree::interrupting_a_codex_run_stops_a_command_in_its_own_session eight-second timing assertion. The exact test passed on rerun in 2.40 seconds. The complete process-tree target and every remaining target then passed in a separate Cargo run; no process-interruption source or tests changed in this PR. All Rust test targets have passing results across these runs.

Testing seams: Console HTTP with the compiled binary and Resend stand-in; the shared Accounts interface with controlled time and an external email sender; Console CLI password/log commands; browser sign-in/sign-out. Durable account-file inspection checks the required hash-only storage and verified flag. HTTP expiry/day-limit tests prepare aged durable input with the server stopped.

Merge Danger

Door: two-way

Blast Radius: accounts

Changes Console password setup and shared anonymous-page rendering. Account data gains defaulted verification/code fields; existing password sign-in and CLI account management stay covered.

Review coverage

Independent Standards and Spec reviews used fetched issue-776 pinned at 77886506f6fb76ec5797f2a0c6de64559e7f7047. Both read all 12 changed files. No generated-output exclusions and no unread changed files. Standards' duplication finding and Spec's timing and HTTP-coverage findings were addressed.

Unaddressed findings

Standards

None.

Spec

None.

Built with codex · gpt-6.1-sol · high