Profile API endpoint: show public contact mails or a fake one
Some OAuth2 clients expect an email attribute on the profile page, e.g. HackMD.
Add a field for "public_email" which either takes the first verified public mail from communication channels or generates a fake invalid one.