Any Auth Hooks change in the dashboard silently wipes custom SMTP config and resets rate_limit_email_sent

Bug report

Creating or deleting a Send Email hook in the dashboard silently nulls every custom SMTP field (smtp_host, smtp_user, smtp_pass, smtp_port, smtp_admin_email, smtp_sender_name) and resets rate_limit_email_sent (in our case from a configured 25 back to 2). No warning, no confirmation, and nothing in the UI indicates SMTP was touched.

Reproduced twice on the same project (create hook, delete hook — each Auth Hooks change wiped the SMTP config again).

Why this is dangerous

While the Send Email hook is enabled, the wipe is invisible — the hook bypasses SMTP entirely, so mail keeps flowing. The failure only surfaces later, when the hook is disabled for any reason, at which point ALL auth email stops silently and completely. We now run an external drift monitor specifically to detect this state (hook enabled + smtp_* nulled) because the dashboard gives no signal that it exists.

Expected behavior

Auth Hooks changes should not modify unrelated SMTP / rate-limit configuration. If there is a real dependency, warn and require confirmation instead of silently wiping. Happy to share the affected project ref with Supabase staff privately.