Forms: verify an email field with a one-time code before a submission is accepted

Found by simulating a Claude Code build of Color Me Fun 2026 through the barako CLI (epic #801) on 14 September 2026; the event registration app for the Rotary Club of Koronadal is the acceptance test. Simulation page: https://claude.ai/code/artifact/05afda1a-6461-431d-aff0-50b30d3b0778

A registration cannot continue with an email address that has not proved it receives mail, because every confirmation is email only. One-time codes exist for signing in (`/api/auth/otp/*`), not for a field on a public form.

## Change

A form's email field can require verification: the visitor requests a code, it is sent through the configured email module, and the submission is accepted only with a matching unexpired code for that address. Codes are hashed, single use, expire, and are rate limited per address and per IP.

## Done when

- A submission with an unverified address is refused; with a verified one it is accepted and the entry records that the address was verified.
- Requesting codes repeatedly for one address is throttled.

## Where it lives

Module: `BarakoCMS.Forms`, using the core's one-time code service.

Start in the BarakoCMS.Forms module and inspect the core one-time code service used by `/api/auth/otp/*`, along with the configured email module. Trace how public form submissions are accepted, then define the verification flow and its storage and throttling boundaries. Done means unverified submissions are refused, verified entries record that state, and repeated requests for one address are throttled.

Written by the indexing model from the issue text.