Passwordless-only auth: drop registration and passwords entirely

There is now one way in: POST /api/auth/magic-link with an email address. It
creates the account (unverified) if the address is new -- that's the only
"sign up" -- and emails a sign-in link either way, subject to the existing
60s-per-user resend throttle. Opening the link (POST /api/auth/verify-email,
unchanged) is what actually creates the session, and marks the address
verified the first time. Since a session can now only ever come from an
opened link, "authenticated" implies "verified" -- there's no more
authenticated-but-unverified state, so the resend-verification endpoint and
all the "verify your email" nagging UI are gone too.

Backend
- migrations/008: ALTER TABLE users DROP COLUMN password_hash.
- UserRepository: create() takes only an email; new findOrCreateByEmail()
  (race-safe) backs the magic-link endpoint.
- AuthController: register()/login() removed; requestLoginLink() now
  find-or-creates before sending.
- EmailVerificationController: resend() removed (dead -- you can't be
  authenticated and unverified); requestChange() drops the password check,
  now just { email }.
- EmailVerifier: sendVerification() removed (unused once register() and
  resend() are gone); sendLoginLink() is the one email people get.
- Routes: POST /auth/register, POST /auth/login, POST /email/verification
  all gone.

Frontend
- LoginView: email field + "Send sign-in link" button, nothing else.
  RegisterView and the /register route are gone.
- auth store: register()/login()/resendVerification() removed;
  requestEmailChange() drops the password param.
- ProfileView: password field and the "verify your email" section removed,
  leaving just the change-email form.
- App.vue: the "verify email" header badge is gone; DashboardView's
  unverified-address notice is gone.
- Now-dead .badge/.badge--warn/a.badge CSS removed.

Tests: AuthTest and EmailVerificationTest rewritten for the new flow (52
tests total, down from 58 -- consolidated, not reduced coverage).
ApiTestCase::authHeader() signs in via the real magic-link -> verify flow.

Verified end-to-end against the rebuilt container and the dev server: a brand
new address gets an account + session from one link; /auth/register,
/auth/login and /email/verification all 404; the UI shows no password field
anywhere and no verification nagging. Also fixed the README's "Try it" curl
snippets, which had been silently broken since JSON_PRETTY_PRINT was added
(grep patterns didn't tolerate the space after ':').

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/views/ProfileView.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, onBeforeUnmount, ref } from 'vue'
+import { onBeforeUnmount, ref } from 'vue'
 import { ApiError } from '../lib/api'
 import { useAuthStore } from '../stores/auth'
 
@@ -19,34 +19,8 @@ function startCooldown(seconds: number) {
 
 onBeforeUnmount(() => clearInterval(timer))
 
-// --- resend verification -------------------------------------------------
-const resending = ref(false)
-const resendMessage = ref('')
-const resendError = ref('')
-
-async function onResend() {
-  resending.value = true
-  resendMessage.value = ''
-  resendError.value = ''
-  try {
-    const retryAfter = await auth.resendVerification()
-    resendMessage.value = `Sent. Check ${auth.user?.email}.`
-    startCooldown(retryAfter)
-  } catch (e) {
-    if (e instanceof ApiError) {
-      resendError.value = e.message
-      if (e.status === 429) startCooldown(e.retryAfter ?? 60)
-    } else {
-      resendError.value = 'Could not send the email.'
-    }
-  } finally {
-    resending.value = false
-  }
-}
-
 // --- change email ------------------------------------------------------
 const newEmail = ref('')
-const password = ref('')
 const changing = ref(false)
 const changeMessage = ref('')
 const changeError = ref<ApiError | null>(null)
@@ -56,10 +30,9 @@ async function onChangeEmail() {
   changeMessage.value = ''
   changeError.value = null
   try {
-    const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value, password.value)
+    const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value)
     changeMessage.value = `Confirmation link sent to ${pending_email}. Your address changes once you open it.`
     newEmail.value = ''
-    password.value = ''
     startCooldown(retry_after)
   } catch (e) {
     changeError.value = e instanceof ApiError ? e : new ApiError('Could not request the change.', 0)
@@ -68,25 +41,14 @@ async function onChangeEmail() {
     changing.value = false
   }
 }
-
-const resendLabel = computed(() => {
-  if (resending.value) return 'Sending…'
-  if (cooldown.value > 0) return `Resend in ${cooldown.value}s`
-  return 'Resend verification email'
-})
 </script>
 
 <template>
   <section class="card">
-    <p><RouterLink to="/">&larr; Back to lists</RouterLink></p>
+    <p><RouterLink to="/">&larr; Dashboard</RouterLink></p>
     <h1>Your profile</h1>
 
     <p><strong>Email:</strong> {{ auth.user?.email }}</p>
-    <p>
-      <strong>Status:</strong>
-      <span v-if="auth.emailVerified">verified</span>
-      <span v-else class="badge badge--warn">not verified</span>
-    </p>
 
     <div v-if="auth.user?.pending_email" class="notice">
       A change to <strong>{{ auth.user.pending_email }}</strong> is pending. Open the
@@ -94,21 +56,12 @@ const resendLabel = computed(() => {
       after it was sent.
     </div>
 
-    <section v-if="!auth.emailVerified">
-      <h2>Verify your email</h2>
-      <p class="muted">
-        We sent a link to {{ auth.user?.email }}. It expires 15 minutes after
-        it's sent. You can resend it once a minute.
-      </p>
-      <button type="button" :disabled="resending || cooldown > 0" @click="onResend">
-        {{ resendLabel }}
-      </button>
-      <p v-if="resendMessage" class="muted">{{ resendMessage }}</p>
-      <p v-if="resendError" class="form-error">{{ resendError }}</p>
-    </section>
-
     <section>
       <h2>Change email address</h2>
+      <p class="muted">
+        We'll email a confirmation link to the new address; the change only
+        takes effect once you open it.
+      </p>
       <form class="form" @submit.prevent="onChangeEmail">
         <label>
           <span>New email</span>
@@ -117,13 +70,6 @@ const resendLabel = computed(() => {
             {{ changeError.fieldError('email') }}
           </small>
         </label>
-        <label>
-          <span>Current password</span>
-          <input v-model="password" type="password" autocomplete="current-password" required />
-          <small v-if="changeError?.fieldError('password')" class="field-error">
-            {{ changeError.fieldError('password') }}
-          </small>
-        </label>
 
         <p v-if="changeError && Object.keys(changeError.details).length === 0" class="form-error">
           {{ changeError.message }}