Add stage 7: email verification magic links and a profile page

Backend
- New Mail namespace: a Mailer interface with SMTP (phpmailer), PHP mail()
  (the default fallback), and log-to-file transports, selected by
  MAIL_TRANSPORT. EmailVerifier issues a hashed, 15-minute magic-link token
  and sends the link (APP_URL/verify-email?token=...).
- Migration 005: email_verifications table + users.verification_email_sent_at.
- Registration now emails a verification link (best effort — a send failure
  doesn't fail registration).
- POST /api/auth/verify-email consumes a token and returns a session, so
  opening the link verifies the address (or applies a pending email change)
  and logs the user in. Single-use; distinct 400s for invalid/used/expired.
- POST /api/email/verification resends; POST /api/email/change requests a
  deferred change (current password required; link goes to the new address;
  users.email only updates when that link is opened). Both throttled to once
  per 60s, returning 429 + retry_after.
- GET /api/me and every session payload now include pending_email. Shared
  SessionPayload builds the user/session JSON for all entry points.

Frontend
- /verify-email view: posts the token, adopts the returned session, redirects.
- /profile view: shows address + status, a resend button with a live cooldown
  (driven by retry_after / 429), and a change-email form (new address +
  current password) that surfaces the pending change.
- Header shows a "verify email" badge linking to the profile.

Tests: 9 new (EmailVerificationTest) covering the link lifecycle, throttle,
and deferred change; AuthTest folded into ApiTestCase, which now routes mail
to a per-test log. Suite: 32 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/views/ProfileView.vue

@@ -0,0 +1,139 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref } from 'vue'
+import { ApiError } from '../lib/api'
+import { useAuthStore } from '../stores/auth'
+
+const auth = useAuthStore()
+
+const cooldown = ref(0)
+let timer: ReturnType<typeof setInterval> | undefined
+
+function startCooldown(seconds: number) {
+  cooldown.value = Math.max(0, Math.ceil(seconds))
+  clearInterval(timer)
+  timer = setInterval(() => {
+    cooldown.value -= 1
+    if (cooldown.value <= 0) clearInterval(timer)
+  }, 1000)
+}
+
+onBeforeUnmount(() => clearInterval(timer))
+
+// --- resend verification -------------------------------------------------
+const resending = ref(false)
+const resendMessage = ref('')
+const resendError = ref('')
+
+async function onResend() {
+  resending.value = true
+  resendMessage.value = ''
+  resendError.value = ''
+  try {
+    const retryAfter = await auth.resendVerification()
+    resendMessage.value = `Sent. Check ${auth.user?.email}.`
+    startCooldown(retryAfter)
+  } catch (e) {
+    if (e instanceof ApiError) {
+      resendError.value = e.message
+      if (e.status === 429) startCooldown(e.retryAfter ?? 60)
+    } else {
+      resendError.value = 'Could not send the email.'
+    }
+  } finally {
+    resending.value = false
+  }
+}
+
+// --- change email ------------------------------------------------------
+const newEmail = ref('')
+const password = ref('')
+const changing = ref(false)
+const changeMessage = ref('')
+const changeError = ref<ApiError | null>(null)
+
+async function onChangeEmail() {
+  changing.value = true
+  changeMessage.value = ''
+  changeError.value = null
+  try {
+    const { pending_email, retry_after } = await auth.requestEmailChange(newEmail.value, password.value)
+    changeMessage.value = `Confirmation link sent to ${pending_email}. Your address changes once you open it.`
+    newEmail.value = ''
+    password.value = ''
+    startCooldown(retry_after)
+  } catch (e) {
+    changeError.value = e instanceof ApiError ? e : new ApiError('Could not request the change.', 0)
+    if (e instanceof ApiError && e.status === 429) startCooldown(e.retryAfter ?? 60)
+  } finally {
+    changing.value = false
+  }
+}
+
+const resendLabel = computed(() => {
+  if (resending.value) return 'Sending…'
+  if (cooldown.value > 0) return `Resend in ${cooldown.value}s`
+  return 'Resend verification email'
+})
+</script>
+
+<template>
+  <section class="card">
+    <p><RouterLink to="/">&larr; Back to lists</RouterLink></p>
+    <h1>Your profile</h1>
+
+    <p><strong>Email:</strong> {{ auth.user?.email }}</p>
+    <p>
+      <strong>Status:</strong>
+      <span v-if="auth.emailVerified">verified</span>
+      <span v-else class="badge badge--warn">not verified</span>
+    </p>
+
+    <div v-if="auth.user?.pending_email" class="notice">
+      A change to <strong>{{ auth.user.pending_email }}</strong> is pending. Open the
+      link we sent to that address to complete it. The link expires 15 minutes
+      after it was sent.
+    </div>
+
+    <section v-if="!auth.emailVerified">
+      <h2>Verify your email</h2>
+      <p class="muted">
+        We sent a link to {{ auth.user?.email }}. It expires 15 minutes after
+        it's sent. You can resend it once a minute.
+      </p>
+      <button type="button" :disabled="resending || cooldown > 0" @click="onResend">
+        {{ resendLabel }}
+      </button>
+      <p v-if="resendMessage" class="muted">{{ resendMessage }}</p>
+      <p v-if="resendError" class="form-error">{{ resendError }}</p>
+    </section>
+
+    <section>
+      <h2>Change email address</h2>
+      <form class="form" @submit.prevent="onChangeEmail">
+        <label>
+          <span>New email</span>
+          <input v-model="newEmail" type="email" maxlength="255" required />
+          <small v-if="changeError?.fieldError('email')" class="field-error">
+            {{ changeError.fieldError('email') }}
+          </small>
+        </label>
+        <label>
+          <span>Current password</span>
+          <input v-model="password" type="password" autocomplete="current-password" required />
+          <small v-if="changeError?.fieldError('password')" class="field-error">
+            {{ changeError.fieldError('password') }}
+          </small>
+        </label>
+
+        <p v-if="changeError && Object.keys(changeError.details).length === 0" class="form-error">
+          {{ changeError.message }}
+        </p>
+        <p v-if="changeMessage" class="muted">{{ changeMessage }}</p>
+
+        <button type="submit" :disabled="changing || cooldown > 0">
+          {{ changing ? 'Sending…' : cooldown > 0 ? `Wait ${cooldown}s` : 'Send confirmation link' }}
+        </button>
+      </form>
+    </section>
+  </section>
+</template>