Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/routes/admin-assets.js

@@ -19,8 +19,9 @@ import {
   normalizeStudySlug,
   isEnrollableStudySlug,
   makeUnsubUrl,
+  invalidateAllStudySessions,
 } from '../study-helpers.js'
-import { sendStudyReengagementEmail } from '../email.js'
+import { sendStudyReengagementEmail, sendStudyPasswordChangedEmail } from '../email.js'
 
 export function register(app) {
   app.get('/api/admin-assets', requireAdminAuth, async (_req, res) => {
@@ -237,9 +238,9 @@ export function register(app) {
         res.status(400).json({ message: 'Password must be 8–200 characters.' }); return
       }
       user.passwordHash = hashStudyPassword(newPassword)
-      for (const [token, session] of state.studySessions) {
-        if (session.userId === user.id) state.studySessions.delete(token)
-      }
+      invalidateAllStudySessions(user.id)
+      sendStudyPasswordChangedEmail(user.username, user.displayName || user.username)
+        .catch(err => console.error('[admin] password-changed email error:', err))
     }
 
     if (typeof addEnrollment === 'string' && addEnrollment.trim()) {
@@ -265,9 +266,7 @@ export function register(app) {
     const user = state.studyUsers.find(u => u.id === req.params.id)
     if (!user) { res.status(404).json({ message: 'User not found.' }); return }
 
-    for (const [token, session] of state.studySessions) {
-      if (session.userId === user.id) state.studySessions.delete(token)
-    }
+    invalidateAllStudySessions(user.id)
 
     state.studyUsers = state.studyUsers.filter(u => u.id !== user.id)
     queueStudyUsersWrite()