feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -1130,6 +1130,14 @@ export const api = {
     });
   },
 
+  async verifyEmail(token: string): Promise<{ verified: boolean; pending: boolean; message: string }> {
+    return request('/api/v1/auth/verify-email', { method: 'POST', body: JSON.stringify({ token }) });
+  },
+
+  async resendVerification(email: string): Promise<void> {
+    await request('/api/v1/auth/resend-verification', { method: 'POST', body: JSON.stringify({ email }) });
+  },
+
   async adminSendInvite(id: string, email: string): Promise<UserInvite> {
     return request<UserInvite>(`/api/v1/admin/invites/${id}/send`, { method: 'POST', body: JSON.stringify({ email }) });
   },

frontend/src/lib/types.ts

@@ -10,6 +10,8 @@ export interface AuthStatus {
   // Registering without an invite and the e-mail domains of the domain modes (hint on the form)
   registrationMode?: RegistrationMode;
   registrationDomains?: string[];
+  // New accounts confirm their e-mail address by link first
+  emailVerification?: boolean;
   instanceName: string;
   demoMode?: boolean;
   sharingMode?: SharingMode;
@@ -101,6 +103,8 @@ export interface User {
   isActive: boolean;
   // Registered and waiting for an admin's approval (admin user list)
   pendingApproval?: boolean;
+  // Registered, e-mail address not confirmed yet (admin user list)
+  emailUnverified?: boolean;
   alarmChannels?: string[];
   alarmEmail?: string;
   discordWebhookUrl?: string;
@@ -264,6 +268,10 @@ export interface SystemSettings {
   registrationDomains?: string;
   // REGISTRATION_MODE / REGISTRATION_DOMAINS (or ALLOW_REGISTRATION=true) fix it: shown, not editable
   registrationConfiguredViaEnv?: boolean;
+  registrationVerifyEmail?: boolean;
+  registrationVerifyConfiguredViaEnv?: boolean;
+  // Mails with links can go out (mail server and BASE_URL configured)
+  emailLinksAvailable?: boolean;
   // Automatic backups: daily time (HH:MM, server time zone) and days to keep them
   backupEnabled?: boolean;
   backupTime?: string;