v4.2
Email verification
- Email verification on registration: new accounts get a Resend-backed link.
- Friendly verify page confirms the address, with an inline resend on failure.
- "Email not verified" banner with a resend button on the account page.
- Login stays available while an account is still unverified.
- Verification tokens are signed and purpose-scoped; resend is rate-limited.