Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server.js

@@ -27,6 +27,8 @@ import {
   loadCalendarEventsFromDisk,
   loadAuditLogFromDisk,
   loadWebhooksFromDisk,
+  loadStudySessionsFromDisk,
+  queueStudySessionsWrite,
   createBackupSnapshot,
   refreshContentCaches,
   queueHitStatsWrite,
@@ -165,6 +167,7 @@ Promise.all([
   loadCalendarEventsFromDisk(),
   loadAuditLogFromDisk(),
   loadWebhooksFromDisk(),
+  loadStudySessionsFromDisk(),
   refreshContentCaches(),
 ])
   .catch(err => {
@@ -182,9 +185,11 @@ Promise.all([
     // Purge expired study sessions every hour
     setInterval(() => {
       const now = Date.now()
+      let pruned = false
       for (const [token, session] of state.studySessions) {
-        if (session.expiresAt <= now) state.studySessions.delete(token)
+        if (session.expiresAt <= now) { state.studySessions.delete(token); pruned = true }
       }
+      if (pruned) queueStudySessionsWrite()
     }, 60 * 60 * 1000)
 
     // Send study reminder emails for newly released lessons every hour