Make the magic-link resend cooldown configurable

EmailVerifier::RESEND_INTERVAL_SECONDS was a hardcoded class constant
shared (via a copy-of-a-constant) by AuthController and
EmailVerificationController. It's now a constructor param
(resendIntervalSeconds, default 60, same as before) sourced from
Config -- new MAGIC_LINK_RESEND_SECONDS env var, default unchanged.

Docker Compose sets it to 0, so magic links resend immediately during
local development instead of waiting out the throttle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -17,6 +17,9 @@ services:
       # Set to false to stop new accounts being created (existing users can
       # still sign in).
       APP_ALLOW_REGISTRATION: "${APP_ALLOW_REGISTRATION:-true}"
+      # 0 here (unlike the app's own default of 60) so magic links can be
+      # resent immediately while developing -- override if that gets in the way.
+      MAGIC_LINK_RESEND_SECONDS: "${MAGIC_LINK_RESEND_SECONDS:-0}"
       # The SPA and the API are both served from this container.
       APP_URL: "${APP_URL:-http://localhost:8080}"
       # Passkeys: defaults to APP_URL's host (localhost). Browsers require