feat(account): brand and harden the email pipeline

Swap the net/smtp mailer for go-mail behind the existing Mailer seam: the
Message struct now carries a text + HTML body, TLS mode is chosen from the port
(implicit TLS on 465, else mandatory STARTTLS), a dial timeout bounds the
synchronous send, and no client certificate is needed. Add a branded, image-free,
mobile-friendly ru/en HTML template (with a plain-text alternative) rendering a
large readable code and an ignore-notice footer with a landing link.

Add BACKEND_PUBLIC_BASE_URL config (the canonical origin for the email footer
link, never the request Host — anti-injection), required when a relay is
configured.

Fix the email-login address squat: ProvisionEmail creates the account flagged
is_guest until the code is confirmed, so an abandoned login is reaped like any
guest and its address freed; confirming (login or link) clears the flag. Seed the
new account's language from the client, plumbed through the email-login request.

The confirm deeplink, its transport surface and the send rate-limit land in
follow-up work.

backend/internal/account/email.go

@@ -28,6 +28,15 @@ const (
 	emailCodeMaxAttempts = 5
 )
 
+// Confirmation purposes recorded on a pending confirm-code row. They select what
+// verifying the code or the deeplink token does: sign in (login) or link/confirm the
+// address on the current account (link). Email change and account deletion add
+// further purposes in later stages.
+const (
+	purposeLogin = "login"
+	purposeLink  = "link"
+)
+
 // Errors returned by the email confirm-code flow.
 var (
 	// ErrInvalidEmail is returned for an unparseable email address.
@@ -55,14 +64,47 @@ var (
 // account is refused (ErrEmailTaken) — merging two accounts is the link/merge flow —
 // and using an email as a login reuses this mechanism.
 type EmailService struct {
-	store  *Store
-	mailer Mailer
-	now    func() time.Time
+	store   *Store
+	mailer  Mailer
+	baseURL string
+	now     func() time.Time
 }
 
-// NewEmailService constructs an EmailService over store, sending via mailer.
-func NewEmailService(store *Store, mailer Mailer) *EmailService {
-	return &EmailService{store: store, mailer: mailer, now: func() time.Time { return time.Now().UTC() }}
+// NewEmailService constructs an EmailService over store, sending via mailer. baseURL
+// is the canonical public origin (scheme + host) used to build the one-tap confirm
+// deeplink and the email footer landing link; an empty baseURL omits the deeplink
+// (development / log mailer).
+func NewEmailService(store *Store, mailer Mailer, baseURL string) *EmailService {
+	return &EmailService{store: store, mailer: mailer, baseURL: baseURL, now: func() time.Time { return time.Now().UTC() }}
+}
+
+// issueCode generates a fresh confirm-code for (accountID, email), replaces any prior
+// pending confirmation, and mails the branded code in locale; purpose selects the
+// email wording. Only the SHA-256 hash of the code is stored.
+func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
+	code, codeHash, err := generateCode()
+	if err != nil {
+		return err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	msg, err := renderConfirmationEmail(purpose, code, "", s.baseURL, locale)
+	if err != nil {
+		return err
+	}
+	msg.To = email
+	return s.mailer.Send(ctx, msg)
+}
+
+// accountLocale returns the account's preferred UI language for localising email,
+// defaulting to "en" when the account cannot be loaded.
+func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
+	acc, err := s.store.GetByID(ctx, accountID)
+	if err != nil {
+		return "en"
+	}
+	return acc.PreferredLanguage
 }
 
 // RequestCode issues a fresh confirm-code for email to accountID and mails it,
@@ -83,16 +125,7 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	code, hash, err := generateCode()
-	if err != nil {
-		return err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
-		return err
-	}
-	subject := "Your Scrabble confirmation code"
-	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
-	return s.mailer.Send(ctx, addr, subject, body)
+	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -127,32 +160,23 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 }
 
 // RequestLoginCode issues a login confirm-code to the account that owns email,
-// provisioning a fresh (unconfirmed) durable account when the email is new. It is
-// the unauthenticated email-login entry point and, unlike RequestCode,
-// does not refuse an already-confirmed email — that is the ordinary returning-user
-// login. The code is mailed to the address, so only its real owner can complete
-// the login. On first contact browserTZ (the client's detected "±HH:MM" UTC offset)
-// seeds the new account's time zone. It returns the target account id for the
-// subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ string) (uuid.UUID, error) {
+// provisioning a fresh (unconfirmed) guest account when the email is new — it becomes
+// durable once the code is confirmed. It is the unauthenticated email-login entry
+// point and, unlike RequestCode, does not refuse an already-confirmed email — that is
+// the ordinary returning-user login. The code is mailed to the address, so only its
+// real owner can complete the login. On first contact browserTZ (the client's
+// detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
+// language. It returns the target account id for the subsequent LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ)
+	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ, language)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	code, hash, err := generateCode()
-	if err != nil {
-		return uuid.UUID{}, err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, acc.ID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
-		return uuid.UUID{}, err
-	}
-	subject := "Your Scrabble login code"
-	body := fmt.Sprintf("Your login code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
-	if err := s.mailer.Send(ctx, addr, subject, body); err != nil {
+	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil
@@ -191,6 +215,9 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
 	if err := s.store.confirmEmailLogin(ctx, conf.id, acc.ID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
+	if err := s.store.ClearGuest(ctx, acc.ID); err != nil {
+		return Account{}, err
+	}
 	return s.store.GetByID(ctx, acc.ID)
 }