Name the address the code was sent to (3.3)

[nursoda]

The 3.3 twin of #215. Same change, same reasoning; this text repeats
what matters so the pull request stands on its own.

The login challenge said that a code had been sent, but not where to. A user who
receives nothing could not tell whether the account carries the right address at
all. It now names the address in the same masked form the personal settings use:
a*@*.org. The address sits inside the two existing sentences rather than on a
line of its own — a separate line would state the same fact twice, and as a bare
fragment it gives a translator no subject and no verb to make the address agree
with.

Showing the address made a second thing urgent. EMailAddressMasker used to
return anything it could not parse unchanged — harmless while only the
settings read it, a disclosure once a login screen prints it. An address whose local part is quoted —
"jo hn"@example.org, which the standard allows — may hold a space or a second
@ and is delivered normally, and an address written
through occ passes no validation at all. Such a value is now hidden whole, and
because that placeholder names no address, both screens that show one turn it into
the empty string and use the wording that names none.

Why the whole change, not only the hardening

This line normally takes security fixes only, and of the two commits just the
EMailAddressMasker hardening is one. Carrying the naming as well is a deliberate
decision: the two belong together — the hardening exists because the screen
names the address — and splitting them would leave 3.3 with a fail-closed masker
whose only caller does nothing with it, plus a diff that no longer matches the
main line. Keeping the lines identical here is worth more than the smaller change.

Translations lag behind, on purpose

Three strings are new: the two sentences that name the address, and the
enrolment screen's variant without one (Codes will be sent to your primary email address., with a full stop where the existing one has a colon). Until Transifex has
them, a non-English instance renders them in English while every other string
stays translated — the fallback sentences are unchanged and keep their existing
translations. The l10n bot only sees strings that reached the repository, so merge
a few days before a release rather than on the day of it.

Checked

• unit (160), Vitest (78), php-cs-fixer and eslint green
• psalm green — on this line it needs php-legacy, because Psalm 6.8.2 refuses to
  run on PHP 8.5
• the equivalent change on the main line additionally passed 96 smoke checks on
  Nextcloud 33 and 34 and a browser pass through all four screen states

🤖 Generated with Claude Code, verified, tweaked and approved by @nursoda.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!