Corrects the email address of an existing user of the named tenant. That address is
the user's login identity, so this operation changes what they sign in with.

What this operation does

1. Refuses if the TARGET tenant is the platform tenant
   (00000000-0000-0000-0000-000000000001). A caller holding only this
   scope must never be able to redirect a platform-plane account's login identity to
   a mailbox they control.
2. Refuses unless the deployment is customer-operated and the caller is on the
   platform plane.
3. Refuses unless the target user has a live row in the named tenant.
4. Normalises the address to lower case and stores it. The address is the login
   identity from that moment; the previous one no longer authenticates.
5. Revokes the target's live access and refresh tokens, so a session opened under
   the old identity cannot be refreshed.
6. If the user has not activated yet (requirePasswordChange = true)
   and both that account and its tenant are ACTIVE, invalidates the outstanding
   activation link and issues a NEW one to the corrected address.

Step 6 is the reason this operation exists. A tenant provisioned with a mistyped
adminEmail is unreachable: the activation link went to a mailbox nobody

can open, and that administrator is by construction still pending. Correcting the
address without re-issuing the link would leave the tenant exactly as unreachable as
before.

The outstanding link is not left alive. The previous activation token is
invalidated before the replacement is minted, and if it cannot be invalidated the
whole operation is refused 503 with nothing changed — a
200 here would mean two live activation links, one of them addressed to

the wrong mailbox. Independently, a token whose loginId is no longer
this account's login identity is refused at redemption, which is what makes a link
issued before the platform tracked activation JTIs unusable after a correction.

Three outcomes, and activationReissued separates only one of them.
Two of the three report false:

• re-issued — the user was pending and both statuses admit a link.
  activationReissued = true.
• withheld — the user is still pending, but the account or its tenant is not
  ACTIVE. The address IS corrected and nothing is minted, because a live activation
  link for a non-ACTIVE account is a credential that begins working the moment the
  account is resumed. activationReissued = false. The operator resumes
  the account and then uses the activation-token regeneration operation; the link
  sent to the previous address is refused at redemption regardless, because its
  loginId no longer names this account's login identity.
• already activated — nothing is minted, because there is no pending link to
  replace. activationReissued = false.

message is what distinguishes the last two.

Authorization: requires platform.users.appoint-tenant-administrator,
a platform-exclusive scope. Restricted to System Administration tenant (001) users on
PRIVATE_CLOUD / ON_PREMISE deployments.