fix: block sub-keys from accessing/modifying email, account key, and other sub-keys

apps/web/src/views/settings.ejs

@@ -31,7 +31,8 @@
       </div>
     </section>
 
-    <!-- Email -->
+    <!-- Email (hidden for sub-key sessions) -->
+    <% if (!it.isSubKey) { %>
     <section class="bg-gray-900 rounded-xl border border-gray-800 p-6">
       <h2 class="text-sm font-semibold text-gray-300 mb-1">Recovery Email</h2>
       <p class="text-xs text-gray-600 mb-4">Used for account recovery only. Stored as a one-way hash — we can't read it.</p>
@@ -44,6 +45,7 @@
       </div>
       <p id="email-status" class="text-xs mt-2 hidden"></p>
     </section>
+    <% } %>