Add self-service profile email management

backend/tests/test_backend_quality.py

@@ -1384,6 +1384,48 @@ class SnapshotHistoryTests(TempDatabaseMixin, unittest.TestCase):
 
 
 class AuthFlowTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase):
+    async def test_user_can_manage_own_profile_email(self) -> None:
+        db.create_user_if_missing("ProfileViewer", "password123", auth_provider="local")
+        current_user = {"username": "ProfileViewer", "role": "user"}
+
+        saved = await auth_router.update_profile_email(
+            {"email": "viewer@example.com"}, current_user
+        )
+        self.assertEqual(saved["email"], "viewer@example.com")
+        self.assertEqual(
+            db.get_user_by_username("profileviewer").get("email"),
+            "viewer@example.com",
+        )
+
+        cleared = await auth_router.update_profile_email({"email": None}, current_user)
+        self.assertIsNone(cleared["email"])
+        self.assertIsNone(db.get_user_by_username("ProfileViewer").get("email"))
+
+    async def test_user_cannot_claim_another_accounts_email(self) -> None:
+        db.create_user_if_missing(
+            "FirstViewer", "password123", email="shared@example.com", auth_provider="local"
+        )
+        db.create_user_if_missing("SecondViewer", "password123", auth_provider="local")
+
+        with self.assertRaises(HTTPException) as context:
+            await auth_router.update_profile_email(
+                {"email": "SHARED@example.com"},
+                {"username": "SecondViewer", "role": "user"},
+            )
+
+        self.assertEqual(context.exception.status_code, 409)
+
+    async def test_profile_email_requires_valid_address(self) -> None:
+        db.create_user_if_missing("ProfileViewer", "password123", auth_provider="local")
+
+        with self.assertRaises(HTTPException) as context:
+            await auth_router.update_profile_email(
+                {"email": "not-an-email"},
+                {"username": "ProfileViewer", "role": "user"},
+            )
+
+        self.assertEqual(context.exception.status_code, 400)
+
     async def test_forgot_password_is_rate_limited(self) -> None:
         request = _build_request(ip="10.1.2.3")
         payload = {"identifier": "resetuser@example.com"}