fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

Independent adversarial audit verdict was NOT SAFE; fixed:
- P0-1 /auth/confirm no longer trusts the query `type` (pinned to
  'email_change'); a public endpoint feeding an attacker-chosen OTP
  type into verifyOtp was an unintended auth entrypoint.
- P0-2 email sync uses the verifyOtp response user, not a follow-up
  getUser() that may not reflect the just-verified identity; /me now
  reconciles space_members.email against the authoritative auth email
  on load, so a missed sync self-heals (no permanent stale email).
- P1-1 requestEmailChange builds the confirm origin from
  NEXT_PUBLIC_APP_URL only, never request headers (forged Host could
  redirect the confirmation link / capture token_hash).
- P2-1 isSecretConfigField also catches password/token/private_key/
  *_token/*_password so non-conventionally-named credentials can't be
  stored in plaintext integrations.config.
521 tests; build clean.

app/(app)/me/page.tsx

@@ -1,5 +1,6 @@
 import { redirect } from 'next/navigation'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import { PageHeader, PageTitle } from '@/components/ui/page-title'
 import { PERMISSIONS, PERMISSION_CODES } from '@/lib/permissions-catalog'
 import { getMyClassSignups, getMyReservations, getMyCards, getMyVisits, getMyBilling, getMyNotifications, getMyPayments } from '@/lib/actions'
@@ -33,6 +34,19 @@ export default async function MePage() {
     .maybeSingle()
   if (!member) redirect('/signup')
 
+  // Self-heal: auth.users.email is authoritative (only changes after Supabase
+  // confirmation). If the denormalized space_members.email drifted (e.g. the
+  // /auth/confirm sync was missed because the second secure-change link was
+  // opened in a different browser), reconcile it here on the owner's own row.
+  if (user.email && member.email !== user.email) {
+    await createAdminClient()
+      .from('space_members')
+      .update({ email: user.email })
+      .eq('id', member.id)
+      .eq('space_id', member.space_id)
+    member.email = user.email
+  }
+
   const profile = {
     email: (member.email as string | null) ?? '',
     display_name: (member.display_name as string | null) ?? '',

app/auth/confirm/route.ts

@@ -5,35 +5,41 @@
 // the change applies to auth.users only after both links are verified; this
 // route is hit once per link and is idempotent.
 //
-// The denormalized space_members.email is synced to the authoritative
-// auth.users email ONLY here, after a successful verifyOtp — never at request
-// time (the user has not proven ownership yet).
+// This route does EXACTLY ONE thing: confirm an email change. The OTP type is
+// pinned to 'email_change' and the query `type` is intentionally ignored — a
+// public endpoint that fed an attacker-chosen type into verifyOtp would be an
+// unintended auth entrypoint (recovery/magiclink/signup tokens minting a
+// session here, bypassing their real flows).
+//
+// The denormalized space_members.email is synced from the verifyOtp response
+// user (NOT a follow-up getUser(), which is not guaranteed to reflect the
+// just-verified identity in this SSR request). /me additionally reconciles on
+// load, so a missed sync here self-heals.
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
 import { NextResponse } from 'next/server'
-import type { EmailOtpType } from '@supabase/supabase-js'
 
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url)
   const tokenHash = searchParams.get('token_hash')
-  const type = (searchParams.get('type') ?? 'email_change') as EmailOtpType
 
   if (!tokenHash) {
     return NextResponse.redirect(`${origin}/login?error=email_change`)
   }
 
   const supabase = await createClient()
-  const { error } = await supabase.auth.verifyOtp({ type, token_hash: tokenHash })
+  const { data, error } = await supabase.auth.verifyOtp({
+    type: 'email_change',
+    token_hash: tokenHash,
+  })
   if (error) {
     return NextResponse.redirect(`${origin}/login?error=email_change`)
   }
 
-  // Sync the denormalized copy to whatever auth.users now holds. On the first
-  // of two secure-change links the email may still be the old one (no-op);
-  // the second link's hit syncs it. Idempotent either way.
-  const {
-    data: { user },
-  } = await supabase.auth.getUser()
+  // Use the verifyOtp response user. On the first of two secure-change links
+  // auth.users.email is still the old value (no-op sync); the second link's
+  // hit carries the new email. Idempotent; /me reconciles any miss.
+  const user = data.user
   if (user?.email) {
     await createAdminClient()
       .from('space_members')