feat(account): unlink provider + change-email edges (backend + gateway)

Unlink: POST /user/link/unlink (telegram|vk) via account.RemoveIdentity, refusing
the last identity; email is never unlinked. New fbs LinkUnlinkRequest + gateway
link.unlink op, returning the refreshed profile.

Change-email: purposeChange confirm-codes (RequestChangeCode/ConfirmChange) that
atomically replace the account's confirmed email (account.replaceEmailIdentity);
a new address owned by another account is refused without disclosure, never merged.
The one-tap deeplink handles purposeChange too. Reuses the LinkEmail* fbs tables;
gateway link.email.change.{request,confirm} ops + backendclient methods; branded
ru/en change-email copy.

backend/internal/account/link.go

@@ -119,6 +119,57 @@ func (s *EmailService) ConfirmLink(ctx context.Context, accountID uuid.UUID, ema
 	return accountID, true, nil
 }
 
+// RequestChangeCode issues and mails a confirm-code to newEmail for an authenticated
+// email change on accountID, replacing any prior pending code. Like RequestLinkCode it
+// never refuses up front on "taken" (anti-enumeration): possession of newEmail is the
+// authorization, and a conflict with another account is revealed only at confirm — as a
+// non-disclosing refusal, never a merge.
+func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUID, newEmail string) error {
+	addr, err := normalizeEmail(newEmail)
+	if err != nil {
+		return err
+	}
+	if !s.allowSend(addr) {
+		return ErrTooManyRequests
+	}
+	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID))
+}
+
+// ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
+// account's confirmed email with newEmail, freeing the old address. When newEmail is
+// already confirmed by another account it refuses with ErrEmailTaken (surfaced to the
+// user as a non-disclosing "check the address or contact support"), never merging; when
+// the account already owns newEmail it is an idempotent no-op. It returns the usual
+// confirm-code errors (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts,
+// ErrCodeMismatch) and the updated account on success.
+func (s *EmailService) ConfirmChange(ctx context.Context, accountID uuid.UUID, newEmail, code string) (Account, error) {
+	addr, err := normalizeEmail(newEmail)
+	if err != nil {
+		return Account{}, err
+	}
+	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
+	if err != nil {
+		return Account{}, err
+	}
+	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
+	if err != nil {
+		return Account{}, err
+	}
+	if ok && owner != accountID {
+		return Account{}, ErrEmailTaken
+	}
+	if ok && owner == accountID {
+		if err := s.store.consumeConfirmation(ctx, conf.id, s.now()); err != nil {
+			return Account{}, err
+		}
+		return s.store.GetByID(ctx, accountID)
+	}
+	if err := s.store.replaceEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
+		return Account{}, err
+	}
+	return s.store.GetByID(ctx, accountID)
+}
+
 // verifyPendingCode loads and checks the pending confirm-code for (accountID,
 // addr), counting a wrong attempt. It returns the confirmation on success.
 func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUID, addr, code string) (emailConfirmation, error) {