Add verified email change flow for customer accounts

[simonhamp]

What

Lets customers change their account email address from Settings → Account, gated behind a verification step so an address is only adopted once its owner proves control of it.

Flow

1. Customer clicks Change Email Address, enters the new address and confirms their current password (in a Flux modal).
2. A signed, 60-minute confirmation link is sent to the new address; a heads-up notice goes to the old one. Nothing on the account changes yet.
3. Clicking the link (while logged in as the requesting user) atomically swaps users.email, sets email_verified_at, and fires follow-up work.

Pending requests show inline with Resend / Cancel; re-requesting supersedes the previous pending row. Requests are rate-limited (3 per 10 min).

Why / design notes

• Ownership before commit. The change only sticks after the expiring signed link is clicked. This also closes an account-takeover vector: GitHub OAuth login falls back to matching users by email, so an unverified email swap could otherwise hijack a login.
• Stripe stays in sync. On confirmation a queued SyncStripeCustomerDetailsJob calls Cashier's syncStripeCustomerDetails() (skips users with no Stripe ID), so receipts and invoices follow the customer.
• Composer auth hard cut-over. Plugin repository credentials use the email as the Basic-Auth username, so they switch to the new address immediately. The UI warns about auth.json and CI secrets before the change (in the modal) and again in both the confirmation email and the post-change message.
• Audit trail. The email_changes table permanently records old/new email, IP and timestamps, so records tied to a previous address can always be traced back. The plugin access API now also returns a stable user id alongside the email.

Scope decisions

Kept intentionally narrow: no Anystack/sub-license propagation and no grace period on old credentials (hard cut). Team membership rows keyed to the old email are updated on confirmation (skipping unique-constraint collisions). Admin-allowlist accounts are out of scope for now.

Testing

• 19 new feature tests in tests/Feature/EmailChangeTest.php covering the request, validation, rate limiting, resend/cancel, signed/expired/unauthorized confirmation, idempotency, email-taken-after-request, Stripe sync dispatch, team-membership update, and the Composer credential cut-over.
• Existing SettingsTest, PluginAccessTest, TeamManagementTest and NotificationUnsubscribeTest suites remain green.
• Pint clean.

🤖 Generated with Claude Code