feat(identity): email-change changelog — one email per account + history

Elazar directive (2026-07-06): exactly ONE email per account at a time (no separate display/auth/contact emails — avoid the mars/pluto multi-email mess), with historic email changes preserved via a changelog/history rather than silent in-place overwrite. Venus today: single email (text) + emailCanonical (generated) + contactEmail side-field; email UPDATE is silent+unrecoverable. Build: email-change audit trail (who/when/old→new), keep single canonical email. Identity surface = Class-A (auth-adjacent). Priority + build-now-vs-park still open with Elazar.