feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/docsync.go

@@ -270,6 +270,9 @@ func (s *Server) startCompaction() {
 
 func (s *Server) compactOnce() {
 	s.leases.Sweep()
+	if n := s.store.PurgeUnverifiedAccounts(time.Now()); n > 0 {
+		slog.Info("Unbestätigte Registrierungen gelöscht", "count", n)
+	}
 	s.compactMedia(time.Now())
 	_ = s.store.PruneLinkPreviews(time.Now().Add(-30 * 24 * time.Hour))
 	st, err := s.store.CompactDocs(time.Now())