Merge authentication into Questions API

docs/PROFILE_ACCOUNT_OPERATIONS.md

@@ -5,19 +5,23 @@ The profile screen reads account identity from `GET /api/Auth/me`, study prefere
 
 ## Deployment
 
-Set the same non-empty `INTERNAL_PURGE_SECRET` Gitea Actions secret in both the Step 3 and
-Promiscuity repositories. Their deployment workflows create namespace-local
-`medmind-internal-api` Kubernetes secrets from that value.
+Authentication is hosted by the Questions API under `/api/Auth`; it does not depend on the
+legacy Promiscuity Auth API. The merged service continues using the existing `Users`,
+`BlacklistedTokens`, and `SteamAuthTransactions` collections in the `promiscuity` database.
 
-Deploy in this order:
+Configure this Gitea repository secret before deploying:
 
-1. Questions API
-2. Auth API
-3. Godot web client
+- `AUTH_JWT_KEY`: the existing production signing key, unchanged during cutover
 
-The Auth API only removes an account after the Questions API confirms that the user's study
-records were purged. The purge endpoint is idempotent and creates a tombstone that prevents an
-old access token from recreating study data.
+The deployment creates the `ranaze-auth` Kubernetes secret. Steam OpenID callbacks use
+`https://s3q.ranaze.com/api/Auth/steam/callback`. Account deletion invokes the study-data purge
+in process before deleting the user record. The internal purge endpoint remains temporarily for
+older clients and can be removed after the old auth deployment is retired.
+
+Password reset is disabled until an SMTP provider is configured. When enabled, codes expire after
+10 minutes, are stored only as keyed hashes, and invalidate all existing sessions when consumed.
+New and updated accounts require a unique normalized email. Legacy accounts with duplicate emails
+must initiate recovery with their exact username.
 
 ## Data export