Security advisory 2 addressed

VIBE/CHAT_LOG.md

@@ -908,3 +908,9 @@ Remove the entire “New primary email address” block; keep only selecting an
 
 ### Assistant outcome
 Removed the pending primary-email replacement form, client handlers, API routes, service, and obsolete test. The profile now retains only verified alternative promotion, with unverified addresses unable to become primary.
+
+### User
+Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
+
+### Assistant outcome
+Removed the replacement-email workflow entirely. Added cleanup migration 14 for its unused table; verified alternatives remain the only addresses eligible for primary selection.

VIBE/PROMPTS.md

@@ -154,6 +154,7 @@
 145. For the new password in the user setting add a validation field to make sure they are the same before submitting
 146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
 147. Make sure the web plugin follows same logic
+154. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings
 146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
 147. Make sure the web plugin follows same logic
 148. In the plugin <span data-i18n="emailLabel">emailLabel</span> should read: <span data-i18n="emailLabel">Email</span>
@@ -162,6 +163,7 @@
 151. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5.
 152. Make sure an email can only be selected when it has been validated.
 153. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
+155. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
 
 ## Future entries