feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -27,6 +27,8 @@ TZ=Europe/Berlin
 #   open             jeder, sofort aktiv
 # REGISTRATION_MODE=approval
 # REGISTRATION_DOMAINS=firma.de, familie.de
+# Neue Konten ohne Einladung bestätigen zuerst ihre E-Mail-Adresse per Link (braucht SMTP und BASE_URL):
+# REGISTRATION_VERIFY_EMAIL=true
 # Alt: true entspricht REGISTRATION_MODE=open; false lässt die Wahl dem Admin.
 ALLOW_REGISTRATION=false