Add full portal expansion: 2FA, change password, history, announcements, recording guidelines, Seafile link, draft saving, file validation; v2.0.17

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/email.js

@@ -805,3 +805,38 @@ export async function sendNuggetsHostWelcomeEmail({ to, name, username, password
     console.error('[nuggets-welcome] send exception:', err)
   }
 }
+
+export async function sendNuggetsHostOtpEmail({ to, name, code }) {
+  if (!process.env.RESEND_API_KEY || !to) return
+  const resend = new Resend(process.env.RESEND_API_KEY)
+  const from = process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM
+
+  const bodyHtml = `
+    <p style="margin:0 0 14px;font-family:Georgia,serif;font-size:15px;color:#c8c0ac;">Hi <strong style="color:#f0ead8;">${escapeHtml(name)}</strong>,</p>
+    <p style="margin:0 0 20px;font-family:Georgia,serif;font-size:15px;color:#c8c0ac;">
+      Your one-time sign-in code for the Nuggets host portal is below. It expires in 10 minutes.
+    </p>
+    <div style="margin:0 0 24px;padding:20px 24px;background:#1a1a15;border:1px solid #2a2518;border-radius:4px;text-align:center;">
+      <span style="font-family:monospace;font-size:36px;font-weight:700;letter-spacing:8px;color:#c9a84c;">${escapeHtml(code)}</span>
+    </div>
+    <p style="margin:0;font-family:Georgia,serif;font-size:14px;color:#7a7060;">If you did not request this code, you can safely ignore this email.</p>
+  `
+
+  try {
+    const { error } = await resend.emails.send({
+      from,
+      to: [to],
+      subject: 'Your Nuggets Portal Sign-In Code',
+      text: `Hi ${name},\n\nYour one-time sign-in code is: ${code}\n\nIt expires in 10 minutes. If you did not request this, ignore this email.`,
+      html: buildBrandedEmailHtml({
+        title: 'Sign-In Code',
+        eyebrow: 'Nuggets',
+        bodyHtml,
+        footerHtml: '<p style="margin:0;font-family:Arial,sans-serif;font-size:12px;color:#7a7060;">You received this because a sign-in was attempted on the Nuggets podcast host portal.</p>',
+      }),
+    })
+    if (error) console.error('[nuggets-otp] send error:', error)
+  } catch (err) {
+    console.error('[nuggets-otp] send exception:', err)
+  }
+}