primary email change functionality

VIBE/CHAT_LOG.md

@@ -878,3 +878,33 @@ The login page should ask for OTP password.
 
 ### Assistant outcome
 Added an optional “One-time password (when configured)” field to the web login page. The form sends a trimmed OTP value to the existing OTP-aware login endpoint and displays the backend’s OTP error when required or invalid.
+
+### User
+Allow secondary or tertiary email addresses, validate them before authentication, show their status in the profile, allow resending validation mail, and retain a holdback period.
+
+### Assistant outcome
+Added independently tracked secondary and tertiary addresses with verification tokens, email-based authentication only for validated addresses, profile status/add/resend/remove controls, a maximum of two additional addresses, and persistent resend throttling with 20-second intervals, five sends, and a two-minute cooldown.
+
+### User
+Enable users to change the primary email address and remove the original one while maintaining access and rights.
+
+### Assistant outcome
+Added a pending primary-email replacement workflow. The original address remains active until the new address is validated, preserving the same account, privileges, and sessions; after validation the new address replaces the original. Added profile controls, verification/resend handling, migration 13, tests, documentation, and security-audit notes.
+
+### User
+Choose the primary email from already verified alternative addresses and increase the allowed alternatives to five.
+
+### Assistant outcome
+Verified alternative addresses can now be promoted to primary from the profile page. The previous primary is retained as a verified alternative, preserving the account identity and access. The maximum number of additional addresses was increased from two to five, with test and documentation updates.
+
+### User
+Make sure an email can only be selected when it has been validated.
+
+### Assistant outcome
+Made validated status explicit in the email-address API and profile UI. Only verified alternatives expose and render the primary-selection action, while the backend rejects any unverified promotion attempt.
+
+### User
+Remove the entire “New primary email address” block; keep only selecting an existing alternative as primary.
+
+### Assistant outcome
+Removed the pending primary-email replacement form, client handlers, API routes, service, and obsolete test. The profile now retains only verified alternative promotion, with unverified addresses unable to become primary.