Passwordless-only auth: drop registration and passwords entirely

There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.

Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
  (race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
  find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
  authenticated and unverified); requestChange() drops the password check,
  now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
  resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
  all gone.

Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
  RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
  requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
  leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
  unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.

Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.

Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Repository/UserRepository.php

@@ -5,11 +5,14 @@ declare(strict_types=1);
 namespace App\Repository;
 
 use PDO;
+use PDOException;
 
 /**
  * Data access for the `users` table. Rows are returned as associative arrays.
+ * There is no password: an account is created (if needed) and authenticated
+ * entirely by opening an emailed magic link.
  *
- * @phpstan-type UserRow array{id: int, email: string, password_hash: string, email_verified_at: string|null, verification_email_sent_at: string|null, created_at: string, updated_at: string}
+ * @phpstan-type UserRow array{id: int, email: string, email_verified_at: string|null, verification_email_sent_at: string|null, created_at: string, updated_at: string}
  */
 final class UserRepository
 {
@@ -46,15 +49,10 @@ final class UserRepository
     /**
      * @return UserRow
      */
-    public function create(string $email, string $passwordHash): array
+    public function create(string $email): array
     {
-        $stmt = $this->pdo->prepare(
-            'INSERT INTO users (email, password_hash) VALUES (:email, :password_hash)'
-        );
-        $stmt->execute([
-            'email' => $email,
-            'password_hash' => $passwordHash,
-        ]);
+        $stmt = $this->pdo->prepare('INSERT INTO users (email) VALUES (:email)');
+        $stmt->execute(['email' => $email]);
 
         /** @var UserRow $user */
         $user = $this->findById((int) $this->pdo->lastInsertId());
@@ -62,6 +60,32 @@ final class UserRepository
         return $user;
     }
 
+    /**
+     * The user for this address, creating one (unverified) if it doesn't exist
+     * yet -- this is the only "sign up".
+     *
+     * @return UserRow
+     */
+    public function findOrCreateByEmail(string $email): array
+    {
+        $existing = $this->findByEmail($email);
+        if ($existing !== null) {
+            return $existing;
+        }
+
+        try {
+            return $this->create($email);
+        } catch (PDOException $e) {
+            // Lost a race with a concurrent request for the same address.
+            $row = $this->findByEmail($email);
+            if ($row === null) {
+                throw $e;
+            }
+
+            return $row;
+        }
+    }
+
     public function markEmailVerified(int $id): void
     {
         $this->pdo->prepare(