Kratos question - is there a way to prevent a user from changing their email address through the API? I understand we can just leave that field out of the UI, but technically a user could still hit the API directly to push that change. I'm assuming some fanciness with actions?

yes, actions/webhooks would be the way currently to prevent this.