Cambio de email con doble confirmación (completa el bloque de auth)

- lib/change-email.ts: requestEmailChange (valida pass/email/token, crea activación
  con old_email/old_email_hash, email al correo actual), confirmOldEmail (marca is_used,
  email al nuevo), confirmNewEmail (re-deriva verifier con el nuevo email + actualiza
  battlenet_accounts y account; borra la activación).
- components/ConfirmClient.tsx: cliente genérico que confirma un hash por POST al abrir.
- Routes /api/account/change-email, /confirm-old-email, /confirm-new-email.
- Páginas /change-email (protegida) y /confirm-old-email, /confirm-new-email (auto).
- Catálogos ChangeEmail, ConfirmOldEmail, ConfirmNewEmail.

Verificado: change-email protegida (401/redirect), confirmaciones con hash inválido
-> invalidLink sin crash. AUTH 100% reimplementado en Next.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/api/account/change-email/route.ts

@@ -0,0 +1,23 @@
+import { getSession } from '@/lib/session'
+import { requestEmailChange } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  let b: Record<string, string> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  return Response.json(
+    await requestEmailChange(
+      session,
+      String(b.currentPassword ?? ''),
+      String(b.currentEmail ?? ''),
+      String(b.newEmail ?? ''),
+      String(b.confEmail ?? ''),
+      String(b.token ?? ''),
+    ),
+  )
+}

web-next/app/api/account/confirm-new-email/route.ts

@@ -0,0 +1,13 @@
+import { confirmNewEmail } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  let hash = ''
+  try {
+    const b = await request.json()
+    hash = String(b.hash ?? '')
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  if (!hash) return Response.json({ success: false, error: 'invalidLink' })
+  return Response.json(await confirmNewEmail(hash))
+}

web-next/app/api/account/confirm-old-email/route.ts

@@ -0,0 +1,13 @@
+import { confirmOldEmail } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  let hash = ''
+  try {
+    const b = await request.json()
+    hash = String(b.hash ?? '')
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  if (!hash) return Response.json({ success: false, error: 'invalidLink' })
+  return Response.json(await confirmOldEmail(hash))
+}