Email-based auth flows and caseworker email instruction endpoint

[danielsjoo]

Prerequisite:
run migration script on prod-db that makes emails unique

• support login and forgot-password using username or email while keeping username as the internal account key
• improve profile email update handling (duplicate email error behavior, allow clearing email to empty string, send notification when email changes)
• add new authenticated route/service to send login-instruction emails to client accounts from caseworker profile workflows
• remove 2FA server routes/services/tests for this branch and keep related auth/session fixes. can add this later with a more rigid design plan.

since the email sending tests I wrote for this (4 integration tests in total) are pretty buggy and I expect emails to be a big part of keep.id in the long term, I made an EmailSender Interface so prod/staging sends real emails and test/in_memory don't. If we ever decide smtp is not good enough, this would make integrating an api like postmark easier as well.