Require email verification for new signups and email changes

[hendriebeats]

Summary

New users must verify their email before they can log in. Existing users are grandfathered as verified. Users who change their email on the profile page trigger a new verification flow — the old address stays active until the new one is confirmed.

Reviewer notes

DB schema

• emailVerified added to user with DEFAULT TRUE so existing accounts aren't locked out. A TODO in the migration notes this default should eventually flip to FALSE; for now all inserts in application code explicitly pass False.
• Separate user_email_verification table tracks tokens — same plaintext pattern as password reset and session tokens already in the codebase.

Token lifecycle

• createVerificationToken deletes any existing unused token for that user before inserting a new one — one pending token per user, always fresh on resend.
• verifyEmailToken updates both user.email and user.emailVerified atomically, then marks the token used; replaying a used/expired token is a no-op returning Nothing.
• Rate limit is checked against sentAt of the current pending row (reset each time a token is created), so it correctly reflects when the last email was actually sent.

Login flow

• getPasswordHash now returns (UserId, PasswordHash, Bool) — the Bool is emailVerified. Password comparison happens first; the verified check only runs after a correct password, so error responses don't distinguish "wrong password" from "unverified".
• loginFormUnverified re-renders the form with unverified = True, which shows the resend button — the email is pre-filled so the HTMX POST can send it without a visible input.

Resend UI

• The resend button is a <button type="button"> with HTMX attrs rather than a nested <form> (nested forms are invalid HTML and browsers silently discard the inner element).
• Client-side countdown timer is cosmetic only — the server enforces the 5-minute window authoritatively.

Profile / email change

• When email is unchanged, updateUser runs as before. When it changes, only the name is updated immediately via updateUserName; the email swap waits until the verification link is clicked. The old address receives an informational notice; the new address receives the verification link.

Signup

• After successful signup, no session cookie is issued — user sees a "check your inbox" partial and must verify before logging in.
• mRedirect is still read and passed through to the error-path form so the redirect is preserved across validation failures.

[hendriebeats]

Note: We'll have to update the DB migration. I set the value at "true" which would automatically verify everyone. Instead, it should migrate once & then be set to false (something like this)