feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -122,6 +122,8 @@ func (s *Server) Router() http.Handler {
 	r.Get("/api/v1/auth/status", s.handleAuthStatus)
 	r.Get("/api/v1/legal/{type}", s.handleLegalText)
 	r.Post("/api/v1/auth/setup", s.handleFirstBootSetup)
+	r.Post("/api/v1/auth/verify-email", s.handleVerifyEmail)
+	r.Post("/api/v1/auth/resend-verification", s.handleResendVerification)
 	r.Post("/api/v1/auth/register", s.handleRegister)
 	r.Post("/api/v1/auth/login", s.handleLogin)
 	r.Post("/api/v1/auth/quickstart", s.handleQuickStart)