New email/password accounts must verify before signing in. Social login
users (Google, Discord) are unaffected. Existing users are grandfathered
via an idempotent migration. Adds a /check-email interstitial with a
resend button, and a --success CSS token for consistent styling.
Closes#343
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
