Add student account self-service security features and discoverability fixes; v2.1.0

Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/content.ts

@@ -1,5 +1,5 @@
-import { DEFAULT_COLOSSIANS_STUDY_SECTIONS } from './colossiansStudyData'
-import type { ColossiansStudySection as ColossiansStudySectionData } from './colossiansStudyData'
+import { DEFAULT_COLOSSIANS_STUDY_SECTIONS } from './legacyColossiansData'
+import type { ColossiansStudySection as ColossiansStudySectionData } from './legacyColossiansData'
 
 export type ColossiansStudySection = ColossiansStudySectionData
 export type StudySection = ColossiansStudySectionData
@@ -296,6 +296,17 @@ export interface SiteContent {
   emailChangeSubject: string
   emailChangeBody: string
   emailChangeCtaLabel: string
+  // ── Verify Email Address (signup) ──
+  emailVerifySubject: string
+  emailVerifyBody: string
+  emailVerifyCtaLabel: string
+  // ── Password Reset ──
+  passwordResetSubject: string
+  passwordResetBody: string
+  passwordResetCtaLabel: string
+  // ── Password Changed Confirmation ──
+  passwordChangedSubject: string
+  passwordChangedBody: string
   // ── 2FA Email OTP ──
   twoFaOtpEmailSubject: string
   twoFaOtpEmailBody: string
@@ -548,6 +559,14 @@ export const DEFAULTS: SiteContent = {
   emailChangeSubject: 'Confirm your new email address',
   emailChangeBody: 'Click the link below to confirm your new account email. If you did not request this change, ignore this message.',
   emailChangeCtaLabel: 'Confirm Email Change',
+  emailVerifySubject: 'Verify your email address',
+  emailVerifyBody: 'Please confirm this is your email address so we can keep your study account secure and deliver reminders you opt into.',
+  emailVerifyCtaLabel: 'Verify Email Address',
+  passwordResetSubject: 'Reset your password',
+  passwordResetBody: 'We received a request to reset the password on your study account. Click below to choose a new password. This link expires in 1 hour.',
+  passwordResetCtaLabel: 'Reset Password',
+  passwordChangedSubject: 'Your password was changed',
+  passwordChangedBody: 'This confirms the password on your study account was just changed. All other active sessions have been signed out. If this wasn’t you, please contact us right away.',
   twoFaOtpEmailSubject: 'Your sign-in code — Verse by Verse with Nate',
   twoFaOtpEmailBody: 'Your two-factor sign-in code is below. Enter it to complete sign-in.',
   twoFaOtpEmailExpiry: 'This code expires in 10 minutes. If you did not request this, you can ignore this message.',