Make the magic-link resend cooldown configurable

EmailVerifier::RESEND_INTERVAL_SECONDS was a hardcoded class constant
shared (via a copy-of-a-constant) by AuthController and
EmailVerificationController. It's now a constructor param
(resendIntervalSeconds, default 60, same as before) sourced from
Config -- new MAGIC_LINK_RESEND_SECONDS env var, default unchanged.

Docker Compose sets it to 0, so magic links resend immediately during
local development instead of waiting out the throttle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -24,6 +24,11 @@ JWT_TTL=86400
 # creating a new account. Closes sign-ups without touching existing users.
 APP_ALLOW_REGISTRATION=true
 
+# Minimum gap, in seconds, before a magic link can be resent to the same
+# address (sign-in or email-change). The Docker Compose setup overrides this
+# to 0 for local development, so links can be resent immediately.
+MAGIC_LINK_RESEND_SECONDS=60
+
 # Base URL the app is reached at. Verification magic links point here, e.g.
 # <APP_URL>/verify-email?token=... The Docker image serves the SPA and the API
 # together on http://localhost:8080; a host `npm run dev` serves it on :5173.