Add stage 7: email verification magic links and a profile page

Backend
- New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail()
  (the default fallback), and log-to-file transports, selected by
  MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token
  and sends the link (APP_URL/verify-email?token=...).
- Migration 005: email_verifications table + users.verification_email_sent_at.
- Registration now emails a verification link (best effort — a send failure
  doesn't fail registration).
- POST /api/auth/verify-email consumes a token and returns a session, so
  opening the link verifies the address (or applies a pending email change)
  and logs the user in. Single-use; distinct 400s for invalid/used/expired.
- POST /api/email/verification resends; POST /api/email/change requests a
  deferred change (current password required; link goes to the new address;
  users.email only updates when that link is opened). Both throttled to once
  per 60s, returning 429 + retry_after.
- GET /api/me and every session payload now include pending_email. Shared
  SessionPayload builds the user/session JSON for all entry points.

Frontend
- /verify-email view: posts the token, adopts the returned session, redirects.
- /profile view: shows address + status, a resend button with a live cooldown
  (driven by retry_after / 429), and a change-email form (new address +
  current password) that surfaces the pending change.
- Header shows a "verify email" badge linking to the profile.

Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle,
and deferred change; AuthTest folded into ApiTestCase, which now routes mail
to a per-test log. Suite: 32 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Auth/SessionPayload.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Auth;
+
+use App\Repository\EmailVerificationRepository;
+
+/**
+ * Builds the JSON representation of a user and the session envelope returned by
+ * register / login / email verification. Shared so every entry point agrees on
+ * the shape.
+ */
+final class SessionPayload
+{
+    public function __construct(
+        private readonly JwtService $jwt,
+        private readonly EmailVerificationRepository $tokens,
+    ) {
+    }
+
+    /**
+     * @param array{id: int, email: string, email_verified_at: string|null, created_at: string} $user
+     * @return array{user: array<string, mixed>, token: string, expires_at: string}
+     */
+    public function forUser(array $user): array
+    {
+        $issued = $this->jwt->issue($user);
+
+        return [
+            'user' => $this->present($user),
+            'token' => $issued['token'],
+            'expires_at' => $issued['expires_at'],
+        ];
+    }
+
+    /**
+     * @param array{id: int, email: string, email_verified_at?: string|null, created_at?: string} $user
+     * @return array<string, mixed>
+     */
+    public function present(array $user): array
+    {
+        $verifiedAt = $user['email_verified_at'] ?? null;
+
+        return [
+            'id' => (int) $user['id'],
+            'email' => $user['email'],
+            'email_verified' => $verifiedAt !== null,
+            'email_verified_at' => $verifiedAt,
+            'pending_email' => $this->tokens->pendingEmailFor((int) $user['id']),
+            'created_at' => $user['created_at'] ?? null,
+        ];
+    }
+}