feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -1130,6 +1130,14 @@ export const api = {
     });
   },
 
+  async verifyEmail(token: string): Promise<{ verified: boolean; pending: boolean; message: string }> {
+    return request('/api/v1/auth/verify-email', { method: 'POST', body: JSON.stringify({ token }) });
+  },
+
+  async resendVerification(email: string): Promise<void> {
+    await request('/api/v1/auth/resend-verification', { method: 'POST', body: JSON.stringify({ email }) });
+  },
+
   async adminSendInvite(id: string, email: string): Promise<UserInvite> {
     return request<UserInvite>(`/api/v1/admin/invites/${id}/send`, { method: 'POST', body: JSON.stringify({ email }) });
   },