Sub-ticket of MARS-182 Admin 'change login email' server action (Google-OAuth identity re-point) — bs-mqq2v3r1802. Mars layer-2 = pure email-bind (auth/callback resolves by normalizedEmail, no authId/no id=uid link), so action is lightest: update users.email (normalizedEmail regenerates) + service-role delete stale old auth.users row. Gate by Mars user-mgmt cap (NOT bare fullAccess), allowlist-check new domain, dedup-guard reject if canonical(new) is a live user, setArchiveContext + audit email delta. Proof-of-control = student re-login on new Google account. No app has this today; Elazar-launched build. · mars