test+docs(email): squat-fix coverage and the email-pipeline docs

Add an integration test asserting the guest-until-confirmed squat fix (an
email-login account is a reapable guest until the code is confirmed, then
durable). Document the branded relay pipeline in ARCHITECTURE (go-mail, TLS by
port, no client cert, PUBLIC_BASE_URL anti-injection, per-recipient send throttle,
guest-until-confirmed), FUNCTIONAL (+ru), TESTING and the backend README config
table (BACKEND_SMTP_* + BACKEND_PUBLIC_BASE_URL).

docs/ARCHITECTURE.md

@@ -232,9 +232,17 @@ arrive from a platform rather than completing a mandatory registration).
   `confirmed` flag. A synthetic `kind='robot'` identity backs each pooled
   robot opponent (§7). The **email confirm-code flow** binds an email to the
   authenticated account: a 6-digit code (stored only as a SHA-256 hash, 15-minute
-  TTL, ≤ 5 attempts) is sent through a `Mailer` seam (an SMTP relay, or a
-  development log mailer when none is configured) and, once verified, attaches a
-  confirmed email identity. Accounts and identities use application-generated
+  TTL, ≤ 5 attempts) is sent as a **branded HTML + plain-text email** through a
+  `Mailer` seam (go-mail over the shared relay — implicit TLS on port 465 or
+  STARTTLS, the server certificate validated against the system roots, no client
+  certificate; a development log mailer when no relay is configured) and, once
+  verified, attaches a confirmed email identity. Sends are throttled per recipient
+  (a 60-second cooldown and a five-per-hour cap). Links in the email are built from
+  a configured public base URL, never a request Host header (anti-injection). An
+  **email-login** account is created flagged `is_guest` and stays reapable until the
+  code is confirmed — so an abandoned, never-confirmed login frees its reserved
+  address — with confirming clearing the flag. Accounts and identities use
+  application-generated
   **UUIDv7** primary keys. A service flag `paid_account` (lifetime one-time
   payment; no purchase flow yet) is carried on the account and ORed on a merge.
 - **Linking** is initiated from an authenticated profile and proves

docs/FUNCTIONAL.md

@@ -61,6 +61,12 @@ A **VK Mini App** launch works the same way: it authenticates from VK's signed l
 the name in the signed launch). While the theme preference is "auto" the app follows the VK
 client's light/dark scheme, and the layout clears the VK mobile home bar. The same quiet-retry
 "couldn't load" screen applies inside VK.
+**Email** sign-in (web) mails a branded six-digit confirmation code — localized
+(en/ru), no images — to the address; entering it signs the player in. A new address
+is provisioned on the first request but only becomes a durable account once the code
+is confirmed, so an abandoned, never-confirmed attempt is cleaned up and its address
+freed. Sends are rate-limited (a short cooldown between codes and a small hourly cap
+per address), so a mistyped address or an impatient tap cannot flood an inbox.
 Telegram runs a **single bot**: every player uses
 the same bot, and all of its chat and out-of-app notifications are written in the
 player's own **interface language** (en/ru). A separate optional **promo bot** can run alongside the

docs/FUNCTIONAL_ru.md

@@ -65,7 +65,14 @@ launch-параметрам VK (их проверяет gateway), и при пе
 так как VK не кладёт имя в подписанный запуск). Пока тема в режиме «авто», приложение следует
 светлой/тёмной схеме VK-клиента, а раскладка обходит нижнюю home-bar VK на мобильных. Тот же экран
 тихого повтора «не удалось
-загрузить» действует и внутри VK. Telegram держит **единого бота**: все игроки пользуются одним
+загрузить» действует и внутри VK.
+**Email**-вход (в вебе) отправляет на адрес брендированный шестизначный код подтверждения —
+локализованный (ru/en), без картинок; после ввода игрок входит. Новый адрес заводится при первом
+запросе, но становится постоянным аккаунтом только после подтверждения кода — так брошенная,
+неподтверждённая попытка вычищается, а адрес освобождается. Отправки ограничены по частоте (короткая
+пауза между кодами и небольшой часовой лимит на адрес), чтобы опечатка в адресе или нетерпеливый тап
+не завалили почтовый ящик.
+Telegram держит **единого бота**: все игроки пользуются одним
 и тем же ботом, а весь его чат и внеприложенческие уведомления пишутся на **языке
 интерфейса** самого игрока (en/ru). Рядом с основным может работать отдельный опциональный
 **промо-бот** — его единственная задача отвечать на `/start` коротким сообщением и кнопкой,

docs/TESTING.md

@@ -69,7 +69,10 @@ tests or touching CI.
   content and block-visibility rules, the nudge turn/rate-limit rules, the
   invitation flow (all-accept starts the game, decline cancels, lazy expiry,
   inviter-only cancel), and the email confirm-code flow (request/confirm, taken
-  email, expiry and attempt-cap) with a fixture mailer. It also covers the
+  email, expiry and attempt-cap, and the guest-until-confirmed login) with a fixture
+  mailer. The branded email template render (en/ru subject, code and body) and the
+  per-recipient send-rate limiter (cooldown + hourly cap) are pure account-package
+  unit tests, needing no database. It also covers the
   **befriend-an-opponent** gate (a request needs a shared game), the **permanent
   decline** and 30-day re-send rule, the **one-time friend code** (issue/redeem,
   self/single-use, decline-bypass), `ListInvitations`, the zero-value `GetStats`, and