fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

Independent adversarial audit verdict was NOT SAFE; fixed:
- P0-1 /auth/confirm no longer trusts the query `type` (pinned to
  'email_change'); a public endpoint feeding an attacker-chosen OTP
  type into verifyOtp was an unintended auth entrypoint.
- P0-2 email sync uses the verifyOtp response user, not a follow-up
  getUser() that may not reflect the just-verified identity; /me now
  reconciles space_members.email against the authoritative auth email
  on load, so a missed sync self-heals (no permanent stale email).
- P1-1 requestEmailChange builds the confirm origin from
  NEXT_PUBLIC_APP_URL only, never request headers (forged Host could
  redirect the confirmation link / capture token_hash).
- P2-1 isSecretConfigField also catches password/token/private_key/
  *_token/*_password so non-conventionally-named credentials can't be
  stored in plaintext integrations.config.
521 tests; build clean.

lib/secrets/vault.ts

@@ -72,10 +72,18 @@ export async function readSecret(
 // are never themselves secrets.
 export function isSecretConfigField(key: string): boolean {
   if (key.endsWith('_set') || key.endsWith('_ref')) return false
+  const k = key.toLowerCase()
   return (
-    key === 'client_secret' ||
-    key === 'api_key' ||
-    key === 'secret_key' ||
-    key.endsWith('_secret')
+    k === 'client_secret' ||
+    k === 'api_key' ||
+    k === 'secret_key' ||
+    k === 'password' ||
+    k === 'token' ||
+    k === 'private_key' ||
+    k === 'access_token' ||
+    k === 'refresh_token' ||
+    k.endsWith('_secret') ||
+    k.endsWith('_token') ||
+    k.endsWith('_password')
   )
 }