feat(auth): confirm the e-mail address of new accounts by link

- Setting / REGISTRATION_VERIFY_EMAIL; only with SMTP and BASE_URL; invites skip it
- Hashed one-time tokens (48 h), resend with cooldown, unconfirmed accounts purged
- Approval modes notify admins only after the address is confirmed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/system.go

@@ -142,6 +142,8 @@ func (s *Store) GetSystemSettings() (*domain.SystemSettings, error) {
 				settings.RegistrationMode = NormalizeRegistrationMode(v)
 			case "registration_domains":
 				settings.RegistrationDomains = v
+			case "registration_verify_email":
+				settings.RegistrationVerifyEmail = v == "true"
 			case "instance_name":
 				settings.InstanceName = v
 			case "smtp_host":
@@ -245,7 +247,8 @@ func (s *Store) UpdateSystemSettings(settings *domain.SystemSettings) error {
 		('backup_time', ?),
 		('backup_retention_days', ?),
 		('registration_mode', ?),
-		('registration_domains', ?)
+		('registration_domains', ?),
+		('registration_verify_email', ?)
 		ON CONFLICT(key) DO UPDATE SET value = excluded.value`,
 		settings.SharingMode,
 		regStr,
@@ -264,6 +267,7 @@ func (s *Store) UpdateSystemSettings(settings *domain.SystemSettings) error {
 		strconv.Itoa(settings.BackupRetentionDays),
 		settings.RegistrationMode,
 		settings.RegistrationDomains,
+		strconv.FormatBool(settings.RegistrationVerifyEmail),
 	)
 	return err
 }