fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

Independent adversarial audit verdict was NOT SAFE; fixed:
- P0-1 /auth/confirm no longer trusts the query `type` (pinned to
  'email_change'); a public endpoint feeding an attacker-chosen OTP
  type into verifyOtp was an unintended auth entrypoint.
- P0-2 email sync uses the verifyOtp response user, not a follow-up
  getUser() that may not reflect the just-verified identity; /me now
  reconciles space_members.email against the authoritative auth email
  on load, so a missed sync self-heals (no permanent stale email).
- P1-1 requestEmailChange builds the confirm origin from
  NEXT_PUBLIC_APP_URL only, never request headers (forged Host could
  redirect the confirmation link / capture token_hash).
- P2-1 isSecretConfigField also catches password/token/private_key/
  *_token/*_password so non-conventionally-named credentials can't be
  stored in plaintext integrations.config.
521 tests; build clean.

app/(app)/me/page.tsx

@@ -1,5 +1,6 @@
 import { redirect } from 'next/navigation'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 import { PageHeader, PageTitle } from '@/components/ui/page-title'
 import { PERMISSIONS, PERMISSION_CODES } from '@/lib/permissions-catalog'
 import { getMyClassSignups, getMyReservations, getMyCards, getMyVisits, getMyBilling, getMyNotifications, getMyPayments } from '@/lib/actions'
@@ -33,6 +34,19 @@ export default async function MePage() {
     .maybeSingle()
   if (!member) redirect('/signup')
 
+  // Self-heal: auth.users.email is authoritative (only changes after Supabase
+  // confirmation). If the denormalized space_members.email drifted (e.g. the
+  // /auth/confirm sync was missed because the second secure-change link was
+  // opened in a different browser), reconcile it here on the owner's own row.
+  if (user.email && member.email !== user.email) {
+    await createAdminClient()
+      .from('space_members')
+      .update({ email: user.email })
+      .eq('id', member.id)
+      .eq('space_id', member.space_id)
+    member.email = user.email
+  }
+
   const profile = {
     email: (member.email as string | null) ?? '',
     display_name: (member.display_name as string | null) ?? '',