Kundenhoheit: E-Mail-Aenderung mit Bestaetigung, Zuordnungsfehler behoben, Admin-Uebersicht

- E-Mail-Aenderung durch Berater wird erst nach Bestaetigung durch den Kunden
  aktiv (Link an die neue Adresse, Portal kunde/email-bestaetigen); danach
  ziehen alle Eintraege des Kunden und seine Abos mit. Admins aendern direkt.
- Kundenhoheit: E-Mail eines Beraterkontos oder eines Kunden eines anderen
  Beraters wird abgelehnt (beim Speichern und bei der Bestaetigung).
- Fix CustomerPriority::entryExists: aelteste gepruefte Zuordnung gilt,
  Eintraege in Pruefung (is_like) dienen nicht mehr als Vorlage.
- "Berater zuweisen" voreingestellt auf alle Bestellungen des Kunden.
- Neue Admin-Seite Kundenhoheit: offene Pruefungen, Kunden bei mehreren
  Beratern, abgelehnte/offene E-Mail-Aenderungen; Zaehler im Menue.
- Neue Tabelle shopping_user_email_changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/ShoppingUserEmailChange.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Models;
+
+use App\User;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Carbon;
+
+/**
+ * Requested change of a customer's e-mail address. A consultant's change stays pending
+ * until the customer confirms it via the tokenized link sent to the new address; only
+ * then the address is used (login, abo mails). The plaintext token lives only in the
+ * e-mail link, the database stores its SHA-256 hash (see {@see AboCardUpdateLink}).
+ *
+ * @property int $shopping_user_id
+ * @property int|null $number
+ * @property string $old_email
+ * @property string $new_email
+ * @property string|null $token_hash
+ * @property Carbon|null $expires_at
+ * @property Carbon|null $confirmed_at
+ * @property Carbon|null $blocked_at
+ * @property Carbon|null $resolved_at
+ * @property int|null $requested_by_user_id
+ * @property int|null $resolved_by_user_id
+ */
+class ShoppingUserEmailChange extends Model
+{
+    protected $fillable = [
+        'shopping_user_id',
+        'number',
+        'old_email',
+        'new_email',
+        'token_hash',
+        'expires_at',
+        'confirmed_at',
+        'blocked_at',
+        'resolved_at',
+        'requested_by_user_id',
+        'resolved_by_user_id',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'expires_at' => 'datetime',
+            'confirmed_at' => 'datetime',
+            'blocked_at' => 'datetime',
+            'resolved_at' => 'datetime',
+        ];
+    }
+
+    public function shopping_user(): BelongsTo
+    {
+        return $this->belongsTo(ShoppingUser::class, 'shopping_user_id');
+    }
+
+    public function requested_by(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'requested_by_user_id');
+    }
+
+    public static function hashToken(string $token): string
+    {
+        return hash('sha256', $token);
+    }
+
+    /**
+     * Open requests that can still be confirmed.
+     *
+     * @param  Builder<ShoppingUserEmailChange>  $query
+     */
+    public function scopePending(Builder $query): void
+    {
+        $query->whereNull('confirmed_at')->whereNotNull('token_hash')->where('expires_at', '>', now());
+    }
+
+    /**
+     * Changes rejected because of customer sovereignty that an admin has not handled yet.
+     *
+     * @param  Builder<ShoppingUserEmailChange>  $query
+     */
+    public function scopeBlockedOpen(Builder $query): void
+    {
+        $query->whereNotNull('blocked_at')->whereNull('resolved_at');
+    }
+
+    /**
+     * Requests belonging to the same customer (all entries share the customer number).
+     *
+     * @param  Builder<ShoppingUserEmailChange>  $query
+     */
+    public function scopeForCustomer(Builder $query, ShoppingUser $shoppingUser): void
+    {
+        if ($shoppingUser->number > 0) {
+            $query->where('number', $shoppingUser->number);
+        } else {
+            $query->where('shopping_user_id', $shoppingUser->id);
+        }
+    }
+
+    public function isConfirmable(): bool
+    {
+        return $this->confirmed_at === null && $this->token_hash !== null && $this->expires_at?->isFuture();
+    }
+}