test(auth): prove email token lifecycle

Reject verification-link replay and cover real Identity token expiry, replay, email change, and custom username preservation on SQLite.

docs/audits/verification-log.md

@@ -213,3 +213,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-179 | Account-deletion real-SQLite failure/retry tests; sidecar token/cache tests; full backend; Compose validation | Repository root / `tools/summarizer` | Remove the live sidecar-cache and shared tombstone-path gaps without enabling deletion | PASS — lifecycle 6/6, backend 658/658, sidecar 23/23 and Compose config pass. Sidecar failure withholds completion/tombstone until retry; maintenance purge is token-protected; tombstones map to a separate named volume; activation defaults false | Synthetic rows/cache only; no production volume, deletion, restart, provider revocation, backup restore or retention decision | SEC-009 repository cache/storage boundary complete; production activation remains blocked |
 | V-180 | CV operation/store focused real-SQLite tests and full backend | Repository root | Keep dormant CV extraction history consistent with cancellation, deadline recovery and retry before worker claim | PASS — focused 17/17 and backend 660/660. Cancel sets the run terminal immediately, retry reopens it, deadline recovery fails it, and owner/task/subject predicates prevent unrelated updates | Synthetic rows only; no parser/model/MariaDB/production process interruption | AI-004 dormant-row consistency gap closed |
 | V-181 | AI usage meter/operation/workspace/export/deletion real-SQLite tests; EF model check; SQLite/MariaDB scripts; disposable SQLite backfill and fresh application startup; full backend | Repository root | Make Workspace and durable Strategy/CV usage owner-safe, idempotent and independent of deletable private history | PASS — focused 28/28 and backend 663/663; no pending model changes; both providers generate bounded additive DDL; SQLite backfills the synthetic legacy row exactly once; fresh runtime applies through `20260815175236_AddCrossFeatureAiUsage` and serves `/health` | Synthetic local rows only; no provider/model call, MariaDB server, production migration or worker activation. CV retains a conservative reservation and older synchronous AI paths are not yet universal | Main durable usage boundary implemented; remaining synchronous producers stay tracked under POL-001 |
+| V-182 | Real ASP.NET Identity data-protection token integration on SQLite; focused auth tests; full backend | Repository root | Close SEC-005B expiry/replay/custom-username proof without SMTP or production | PASS — valid confirmation succeeds once, replay and zero-lifetime expiry return the same generic failure, a real change-email token preserves a custom username and cannot replay; focused 39/39 and backend 666/666 | Synthetic addresses and ephemeral local data-protection keys only; no email, browser, MariaDB or production call | SEC-005B local token-state gap closed |

docs/verification/sec-005b-email-ownership.md

@@ -12,6 +12,7 @@ Status: `IMPLEMENTED — NOT VERIFIED`. Backend, frontend component, build, migr
 - Local accounts request a new address with their current password. The active address remains unchanged and both current and proposed addresses receive non-secret notifications.
 - `PendingEmail`, `PendingEmailRequestedAtUtc`, and a rotated security stamp make replacement requests invalidate older Identity change-email tokens.
 - Confirmation accepts only the current pending address, uses `UserManager.ChangeEmailAsync`, updates username only when it still tracks the old email, clears pending state, and revokes all sessions/trusted devices.
+- Registration verification links are single-use at the HTTP boundary; an already confirmed account receives the same generic invalid/expired response as an invalid token.
 - Cancellation requires the current password and clears pending state.
 - ASP.NET Identity default token providers are registered; data-protection keys already persist under `Data:Root/keys`.
 
@@ -29,6 +30,7 @@ Status: `IMPLEMENTED — NOT VERIFIED`. Backend, frontend component, build, migr
   - no `Set-Cookie` header and zero client cookies;
   - immediate login returned 403 `email_not_verified` and still zero cookies.
 - No email was sent and no production service or database was contacted.
+- Real ASP.NET Identity data-protection tokens against SQLite prove valid confirmation, replay rejection, expiry rejection, real change-email confirmation, replay rejection and custom-username preservation. Focused auth/token tests pass 39/39; full backend passes 666/666.
 
 ## Blocked or partial checks
 
@@ -56,6 +58,5 @@ dotnet run --no-build --no-launch-profile --project JobTrackerApi/JobTrackerApi.
 ## Remaining acceptance checks
 
 - Real-browser registration, resend, verification, email request, cancellation and confirmation using a local email sink.
-- Expired/replayed real Identity token integration check and custom-username preservation integration check.
 - Disposable MariaDB upgrade/rollback execution.
 - Production SMTP/canonical-origin and rolling-version smoke with synthetic addresses.

docs/work-programmes/master-work-plan.md

@@ -200,7 +200,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Blocker:** in-app browser localhost access was denied by its admin policy check; no safe SMTP sink, disposable MariaDB, or production environment is available.
 - **Evidence:** `docs/verification/sec-005b-email-ownership.md`; focused backend 35/35; full backend 501/501; frontend 151/151 and build; SQLite upgrade and dual-provider migration scripts; isolated API 202/no-cookie and 403/no-cookie checks.
 - **Commit:** none.
-- **Remaining work:** real-browser desktop/mobile/keyboard flows with a local email sink; expired/replayed token and custom-username integration checks; disposable MariaDB migration execution; production SMTP/origin/version-skew verification before `DONE`.
+- **Remaining work:** real-browser desktop/mobile/keyboard flows with a local email sink; disposable MariaDB migration execution; production SMTP/origin/version-skew verification before `DONE`. Real Identity valid/expired/replayed verification and custom-username email-change behavior pass locally (V-182).
 
 ### SEC-006 — Compatible document-parser dependency update