feat(auth,privacy,web): step-by-step login, privacy settings persistence, TOTP QR, and API docs

web/src/api/auth.ts

@@ -33,6 +33,18 @@ export async function revokeAllSessions(): Promise<void> {
   await http.delete("/auth/sessions");
 }
 
+export interface EmailStatusResponse {
+  email: string;
+  registered: boolean;
+  email_verified: boolean;
+  twofa_enabled: boolean;
+}
+
+export async function checkEmailStatus(email: string): Promise<EmailStatusResponse> {
+  const { data } = await http.get<EmailStatusResponse>("/auth/check-email", { params: { email } });
+  return data;
+}
+
 export interface TwoFactorSetupResponse {
   secret: string;
   otpauth_url: string;

web/src/api/users.ts

@@ -14,6 +14,9 @@ interface UserProfileUpdatePayload {
   bio?: string | null;
   avatar_url?: string | null;
   allow_private_messages?: boolean;
+  privacy_last_seen?: "everyone" | "contacts" | "nobody";
+  privacy_avatar?: "everyone" | "contacts" | "nobody";
+  privacy_group_invites?: "everyone" | "contacts";
 }
 
 export async function updateMyProfile(payload: UserProfileUpdatePayload): Promise<AuthUser> {