Add stage 7: email verification magic links and a profile page

Backend
- New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail()
  (the default fallback), and log-to-file transports, selected by
  MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token
  and sends the link (APP_URL/verify-email?token=...).
- Migration 005: email_verifications table + users.verification_email_sent_at.
- Registration now emails a verification link (best effort — a send failure
  doesn't fail registration).
- POST /api/auth/verify-email consumes a token and returns a session, so
  opening the link verifies the address (or applies a pending email change)
  and logs the user in. Single-use; distinct 400s for invalid/used/expired.
- POST /api/email/verification resends; POST /api/email/change requests a
  deferred change (current password required; link goes to the new address;
  users.email only updates when that link is opened). Both throttled to once
  per 60s, returning 429 + retry_after.
- GET /api/me and every session payload now include pending_email. Shared
  SessionPayload builds the user/session JSON for all entry points.

Frontend
- /verify-email view: posts the token, adopts the returned session, redirects.
- /profile view: shows address + status, a resend button with a live cooldown
  (driven by retry_after / 429), and a change-email form (new address +
  current password) that surfaces the pending change.
- Header shows a "verify email" badge linking to the profile.

Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle,
and deferred change; AuthTest folded into ApiTestCase, which now routes mail
to a per-test log. Suite: 32 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -12,6 +12,18 @@ services:
       # Leave blank to auto-generate a secret into the storage volume on first run.
       JWT_SECRET: "${JWT_SECRET:-}"
       JWT_TTL: "${JWT_TTL:-86400}"
+      # Magic links point at the frontend dev server.
+      APP_URL: "${APP_URL:-http://localhost:5173}"
+      # The container has no MTA, so log emails to a file by default. View them with:
+      #   docker compose exec app cat /var/www/storage/mail.log
+      # Set to "smtp" (with MAIL_SMTP_*) or "mail" to actually send.
+      MAIL_TRANSPORT: "${MAIL_TRANSPORT:-log}"
+      MAIL_FROM: "${MAIL_FROM:-no-reply@localhost}"
+      MAIL_SMTP_HOST: "${MAIL_SMTP_HOST:-}"
+      MAIL_SMTP_PORT: "${MAIL_SMTP_PORT:-587}"
+      MAIL_SMTP_USERNAME: "${MAIL_SMTP_USERNAME:-}"
+      MAIL_SMTP_PASSWORD: "${MAIL_SMTP_PASSWORD:-}"
+      MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-tls}"
     volumes:
       # Live source: edit on the host, no image rebuild needed.
       - .:/var/www/html