feat: post-registration key screen + optional email step

apps/web/src/routes/auth.ts

@@ -22,6 +22,22 @@ export function requireAuth(app: Elysia) {
   });
 }
 
+export const account = new Elysia({ prefix: "/account" })
+  .use(requireAuth)
+  // Update email (post-registration or settings)
+  .post("/email", async ({ accountId, body }) => {
+    const emailHash = body.email
+      ? createHash("sha256").update(body.email.toLowerCase().trim()).digest("hex")
+      : null;
+    await sql`UPDATE accounts SET email_hash = ${emailHash} WHERE id = ${accountId}`;
+    return { ok: true };
+  }, {
+    body: t.Object({
+      email: t.Optional(t.String({ description: "Email for recovery and notifications" })),
+    }),
+    detail: { summary: "Update account email", tags: ["account"] },
+  });
+
 export const auth = new Elysia({ prefix: "/auth" })
   // Create a new account — no email required
   .post("/register", async ({ body }) => {