Add stage 7: email verification magic links and a profile page

Backend
- New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail()
  (the default fallback), and log-to-file transports, selected by
  MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token
  and sends the link (APP_URL/verify-email?token=...).
- Migration 005: email_verifications table + users.verification_email_sent_at.
- Registration now emails a verification link (best effort — a send failure
  doesn't fail registration).
- POST /api/auth/verify-email consumes a token and returns a session, so
  opening the link verifies the address (or applies a pending email change)
  and logs the user in. Single-use; distinct 400s for invalid/used/expired.
- POST /api/email/verification resends; POST /api/email/change requests a
  deferred change (current password required; link goes to the new address;
  users.email only updates when that link is opened). Both throttled to once
  per 60s, returning 429 + retry_after.
- GET /api/me and every session payload now include pending_email. Shared
  SessionPayload builds the user/session JSON for all entry points.

Frontend
- /verify-email view: posts the token, adopts the returned session, redirects.
- /profile view: shows address + status, a resend button with a live cooldown
  (driven by retry_after / 429), and a change-email form (new address +
  current password) that surfaces the pending change.
- Header shows a "verify email" badge linking to the profile.

Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle,
and deferred change; AuthTest folded into ApiTestCase, which now routes mail
to a per-test log. Suite: 32 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/AuthTest.php

@@ -4,38 +4,8 @@ declare(strict_types=1);
 
 namespace Tests;
 
-use PDO;
-use PHPUnit\Framework\TestCase;
-use Psr\Http\Message\ResponseInterface;
-use Slim\App;
-use Slim\Psr7\Factory\ServerRequestFactory;
-
-final class AuthTest extends TestCase
+final class AuthTest extends ApiTestCase
 {
-    private App $app;
-    private string $databasePath;
-
-    protected function setUp(): void
-    {
-        $this->databasePath = sys_get_temp_dir() . '/todo-test-' . uniqid() . '.sqlite';
-        putenv('DATABASE_PATH=' . $this->databasePath);
-        $_ENV['DATABASE_PATH'] = $this->databasePath;
-
-        $pdo = new PDO('sqlite:' . $this->databasePath);
-        foreach (glob(dirname(__DIR__) . '/migrations/*.sql') ?: [] as $migration) {
-            $pdo->exec((string) file_get_contents($migration));
-        }
-
-        $this->app = require dirname(__DIR__) . '/src/bootstrap.php';
-    }
-
-    protected function tearDown(): void
-    {
-        @unlink($this->databasePath);
-        putenv('DATABASE_PATH');
-        unset($_ENV['DATABASE_PATH']);
-    }
-
     public function test_registration_returns_a_user_and_token(): void
     {
         $response = $this->request('POST', '/api/auth/register', [
@@ -49,6 +19,7 @@ final class AuthTest extends TestCase
         self::assertSame('ada@example.com', $body['user']['email']);
         self::assertFalse($body['user']['email_verified']);
         self::assertNull($body['user']['email_verified_at']);
+        self::assertNull($body['user']['pending_email']);
         self::assertArrayNotHasKey('password_hash', $body['user']);
         self::assertNotEmpty($body['token']);
     }
@@ -123,31 +94,4 @@ final class AuthTest extends TestCase
         self::assertSame(200, $response->getStatusCode());
         self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
     }
-
-    /**
-     * @param array<string, mixed>|null $body
-     * @param array<string, string> $headers
-     */
-    private function request(string $method, string $path, ?array $body = null, array $headers = []): ResponseInterface
-    {
-        $request = (new ServerRequestFactory())->createServerRequest($method, $path);
-
-        foreach ($headers as $name => $value) {
-            $request = $request->withHeader($name, $value);
-        }
-
-        if ($body !== null) {
-            $request = $request->withParsedBody($body)->withHeader('Content-Type', 'application/json');
-        }
-
-        return $this->app->handle($request);
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private function decode(ResponseInterface $response): array
-    {
-        return (array) json_decode((string) $response->getBody(), true, 512, JSON_THROW_ON_ERROR);
-    }
 }