fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

Independent adversarial audit verdict was NOT SAFE; fixed:
- P0-1 /auth/confirm no longer trusts the query `type` (pinned to
  'email_change'); a public endpoint feeding an attacker-chosen OTP
  type into verifyOtp was an unintended auth entrypoint.
- P0-2 email sync uses the verifyOtp response user, not a follow-up
  getUser() that may not reflect the just-verified identity; /me now
  reconciles space_members.email against the authoritative auth email
  on load, so a missed sync self-heals (no permanent stale email).
- P1-1 requestEmailChange builds the confirm origin from
  NEXT_PUBLIC_APP_URL only, never request headers (forged Host could
  redirect the confirmation link / capture token_hash).
- P2-1 isSecretConfigField also catches password/token/private_key/
  *_token/*_password so non-conventionally-named credentials can't be
  stored in plaintext integrations.config.
521 tests; build clean.

lib/actions/members.ts

@@ -1,7 +1,6 @@
 'use server'
 
 import { revalidatePath } from 'next/cache'
-import { headers } from 'next/headers'
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
 import { linkSubmissionsByEmail } from './forms'
@@ -240,12 +239,10 @@ export async function requestEmailChange(input: { email: string }) {
   const auth = await requireMember(supabase)
   if (!auth.ok) return { error: auth.error }
 
-  const h = await headers()
-  const host = h.get('x-forwarded-host') ?? h.get('host')
-  const proto = h.get('x-forwarded-proto') ?? 'https'
-  const origin = host
-    ? `${proto}://${host}`
-    : process.env.NEXT_PUBLIC_APP_URL || 'https://hackerspace.sh'
+  // Origin from trusted server config ONLY — never request headers. A forged
+  // Host/X-Forwarded-Host could otherwise point the confirmation link at an
+  // attacker origin and capture the victim's token_hash.
+  const origin = process.env.NEXT_PUBLIC_APP_URL || 'https://hackerspace.sh'
 
   const { error } = await supabase.auth.updateUser(
     { email: v.data.email },