this makes sure we don't use an old otp_user_id from an old session

closes #8031

This:
* makes sure that after_database_authentication is called for users with
enabled 2fa.
* handles paranoid mode correctly

fixes #8023

fixes #7757

closes #8029

fixes #8016

closes #8028

This ensures the hostname is downcase and thus subsequent third party library
assumptions hold, namely http-cookie (pulled through faraday-cookie_jar) doesn't
raise

closes #8021

And remove unused translations and make "another pod" translatable.

closes #7896

Use a partial to share code between mobile and desktop, add the new route to the RegistrationController, drop flash message for closed registrations

fixes #7767

fixes #7910

closes #7966

It doesn't add any security to have this encrypted, but it adds
complexity for podmins, because they need to backup the key.

closes #8014

closes #8012

[ci skip]

[ci skip]

closes #8002

closes #8008

Using token doesn't make much sense when you can generate new tokens
right below.

closes #8006

They don't make sense on that page, because at this stage, the user
already has an account and also has already entered their password.

closes #8005

closes #8004

fixes #8001

closes #8003

closes #8000

fixes #7997

closes #7998

closes #7994