AccountCollection.changeEmail() does not allow supplying an MFA ticket, preventing email changes on accounts with MFA enabled

[gabgutf]

What happened?

When changing an account's email address, the Stoat backend requires passing an MFA ticket (via the X-MFA-Ticket header) if the user has MFA enabled (relevant server code). However, AccountCollection.changeEmail() does not expose any way to supply one.

This means that users with MFA enabled cannot change their email address.

A possible solution would be for changeEmail() to accept an optional MFATicket parameter. Similar to what is already done in Session.delete().

One possible API implementation would be:

changeEmail(
	newEmail: string,
	currentPassword: string,
	ticket?: MFATicket,
): Promise<void> {
	ticket?._consume();
	return this.client.api.patch(
		"/auth/account/change/email",
		{
			email: newEmail,
			current_password: currentPassword,
		},
		{
			headers: ticket ? { "X-MFA-Ticket": ticket.token } : undefined,
		},
	);
}