fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

Independent adversarial audit verdict was NOT SAFE; fixed:
- P0-1 /auth/confirm no longer trusts the query `type` (pinned to
  'email_change'); a public endpoint feeding an attacker-chosen OTP
  type into verifyOtp was an unintended auth entrypoint.
- P0-2 email sync uses the verifyOtp response user, not a follow-up
  getUser() that may not reflect the just-verified identity; /me now
  reconciles space_members.email against the authoritative auth email
  on load, so a missed sync self-heals (no permanent stale email).
- P1-1 requestEmailChange builds the confirm origin from
  NEXT_PUBLIC_APP_URL only, never request headers (forged Host could
  redirect the confirmation link / capture token_hash).
- P2-1 isSecretConfigField also catches password/token/private_key/
  *_token/*_password so non-conventionally-named credentials can't be
  stored in plaintext integrations.config.
521 tests; build clean.

__tests__/secrets-vault.test.ts

@@ -3,13 +3,17 @@ import { isSecretConfigField } from '@/lib/secrets/vault'
 
 describe('isSecretConfigField', () => {
   it('treats credential-named fields as secrets to vault', () => {
-    for (const k of ['client_secret', 'api_key', 'secret_key', 'webhook_secret', 'signing_secret']) {
+    for (const k of [
+      'client_secret', 'api_key', 'secret_key', 'webhook_secret', 'signing_secret',
+      'password', 'token', 'private_key', 'access_token', 'refresh_token',
+      'admin_password', 'bot_token', 'CLIENT_SECRET',
+    ]) {
       expect(isSecretConfigField(k)).toBe(true)
     }
   })
 
   it('leaves non-secret config fields in plaintext config', () => {
-    for (const k of ['client_id', 'sandbox', 'mode', 'publishable_key', 'username']) {
+    for (const k of ['client_id', 'sandbox', 'mode', 'publishable_key', 'username', 'tokenize_mode']) {
       expect(isSecretConfigField(k)).toBe(false)
     }
   })