Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/config.js

@@ -73,6 +73,7 @@ export const EMAIL_SETTINGS_FILE = path.join(DATA_DIR, 'email-settings.json')
 export const CALENDAR_EVENTS_FILE = path.join(DATA_DIR, 'calendar-events.json')
 export const AUDIT_LOG_FILE = path.join(DATA_DIR, 'audit-log.json')
 export const WEBHOOKS_FILE = path.join(DATA_DIR, 'webhooks.json')
+export const STUDY_SESSIONS_FILE = path.join(DATA_DIR, 'study-sessions.json')
 export const MAX_EPISODE_SCRIPT_LENGTH = 200_000 // ~150k words, well beyond any sermon
 
 // Seafile integration for Nuggets episode uploads
@@ -124,6 +125,8 @@ export const MAX_STUDY_ENROLLMENTS_PER_USER = 100
 export const MAX_STUDY_NOTES_PER_USER = 500
 export const MAX_STUDY_NOTE_LENGTH = 12000
 export const EMAIL_CHANGE_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+export const EMAIL_VERIFY_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000
+export const PASSWORD_RESET_TOKEN_TTL_MS = 60 * 60 * 1000
 export const STUDY_SESSION_COOKIE = 'vbn_study_session'
 export const STUDY_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000
 export const STUDY_TOTP_PENDING_TTL_MS = 5 * 60 * 1000