fix: sync harden auth, privacy, and PTS state

internal/app/auth/service.go

@@ -775,10 +775,23 @@ func (s *Service) CancelCodeForAuthKey(ctx context.Context, authKeyID [8]byte, p
 	return s.cancelCode(ctx, authKeyID, phone, phoneCodeHash)
 }
 
+// LoginEmailResetAvailable reports whether this deployment can complete the
+// SMS fallback promised by auth.resetLoginEmail. Fixed development codes are
+// deliberately not a recovery channel.
+func (s *Service) LoginEmailResetAvailable() bool {
+	return s != nil && s.phoneCodeSender != nil && s.codes != nil && s.users != nil
+}
+
 // ConsumeLoginEmailReset authorizes auth.resetLoginEmail with the exact
 // email-login hash previously issued for this phone owner. Possession of only
 // a phone number is never sufficient to remove an authentication factor.
 func (s *Service) ConsumeLoginEmailReset(ctx context.Context, phone, phoneCodeHash string) (int64, error) {
+	// Refuse before consuming the email proof or clearing any account state. If
+	// there is no real SMS sender, the successor code would be the public
+	// development code and could strip the login-email factor.
+	if !s.LoginEmailResetAvailable() || s.codes == nil {
+		return 0, ErrCodeInvalid
+	}
 	phone = normalizePhone(phone)
 	rec, found, err := s.codes.Get(ctx, phoneCodeHash)
 	if err != nil {