feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/migrations.go

@@ -31,6 +31,7 @@ var migrations = []migration{
 	{8, "Journal", (*Store).migrateJournal},
 	{9, "Web-Push", (*Store).migratePush},
 	{10, "Registrierung und Einladungslinks", (*Store).migrateRegistration},
+	{11, "E-Mail-Bestätigung", (*Store).migrateEmailVerification},
 }
 
 func (s *Store) migrate() error {