feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/models.go

@@ -137,6 +137,8 @@ type User struct {
 	CreatedAt           string   `json:"createdAt"`
 	// Registered while registration needs approval and not approved yet (admin user list only)
 	PendingApproval bool `json:"pendingApproval,omitempty"`
+	// Registered and the e-mail address is not confirmed yet (admin user list only)
+	EmailUnverified bool `json:"emailUnverified,omitempty"`
 	// Only filled for the user's own profile (GET /auth/me, PATCH /auth/settings)
 	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty"`
 }
@@ -363,11 +365,17 @@ type SystemSettings struct {
 	// E-mail domains for the domain modes, comma separated ("firma.de, familie.de")
 	RegistrationDomains string `json:"registrationDomains"`
 	// Set by REGISTRATION_MODE / REGISTRATION_DOMAINS (or ALLOW_REGISTRATION=true): not editable here
-	RegistrationConfiguredViaEnv bool   `json:"registrationConfiguredViaEnv,omitempty"`
-	InstanceName                 string `json:"instanceName"`
-	SMTPHost                     string `json:"smtpHost"`
-	SMTPPort                     string `json:"smtpPort"`
-	SMTPUser                     string `json:"smtpUser"`
+	RegistrationConfiguredViaEnv bool `json:"registrationConfiguredViaEnv,omitempty"`
+	// Self-registrations confirm their e-mail address by link first (needs SMTP and BASE_URL)
+	RegistrationVerifyEmail bool `json:"registrationVerifyEmail"`
+	// Set by REGISTRATION_VERIFY_EMAIL: not editable here
+	RegistrationVerifyViaEnv bool `json:"registrationVerifyConfiguredViaEnv,omitempty"`
+	// Mails with links to unknown people can be sent (SMTP and BASE_URL configured)
+	EmailLinksAvailable bool   `json:"emailLinksAvailable,omitempty"`
+	InstanceName        string `json:"instanceName"`
+	SMTPHost            string `json:"smtpHost"`
+	SMTPPort            string `json:"smtpPort"`
+	SMTPUser            string `json:"smtpUser"`
 	// SMTPPass is never sent to the browser (FLAW-34): reads leave it empty and set SMTPPassSet;
 	// writing it empty keeps the stored password
 	SMTPPass    string `json:"smtpPass"`