- Admin API (/api/admin/users, registration links) guarded by require_site_admin:
confirmed profile email must be in ADMIN_EMAILS, checked server-side
- Block unverified switches to an admin email (PUT /me/profile, X-User-Email)
- Users table with registration date, activity counters, resend and delete
- Create, view (active/previous) and delete registration links
- user_profiles.created_at column with backfill
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Simon GruberandClaude Sonnet 5.5
7f7e529b16