Implement email change

prisma/schema.prisma

@@ -13,9 +13,25 @@ model User {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
-  sessions Session[]
-  draft    RuleDraft?
-  rules    PublishedRule[]
+  sessions          Session[]
+  draft             RuleDraft?
+  rules             PublishedRule[]
+  /// At most one pending verified email change (CR-103).
+  emailChangeToken  EmailChangeToken?
+}
+
+/// Pending email change: user must open verify link sent to `newEmail` (CR-103).
+/// Separate from `MagicLinkToken` so sign-in and email-change flows cannot be confused.
+model EmailChangeToken {
+  id        String   @id @default(cuid())
+  userId    String   @unique
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  newEmail  String
+  tokenHash String   @unique
+  expiresAt DateTime
+  createdAt DateTime @default(now())
+
+  @@index([newEmail])
 }
 
 model Session {