Let users choose their password while verifying their email

Allow the user to choose and confirm a password on the email-verification page, so verification can finish without a second password-reset email.

The token-bearing page currently submits verification automatically. Update `src/features/auth/VerifyEmail.tsx` and `src/features/auth/hooks/useVerifyEmail.ts` to collect a password and submit `{ token, newPassword }` only after an explicit action.

Acceptance criteria:
- Apply the existing password/confirmation validation and prevent duplicate submission while pending.
- Render verification outcomes accurately: a password set by this request, verification already complete, a reset email sent, or a need to use Forgot Password. An already-complete result must not imply that the entered password was saved.
- Keep the tokenless resend-verification flow available. Show useful recovery for invalid/expired links and unavailable requests.
- Add end-to-end coverage for successful completion, replay, invalid/expired links, and recovery.

Priority: P3. This removes an extra email step; the reset-email flow remains usable. No release is committed and no specific roadmap item requires this enhancement. No open Studio epic owning this work was found.

Start by reading src/features/auth/VerifyEmail.tsx and src/features/auth/hooks/useVerifyEmail.ts, then trace the existing password/confirmation validation and tokenless resend-verification flow. Add end-to-end coverage for successful completion, replay, invalid or expired links, and recovery. Done means the explicit password submission, pending-state protection, accurate outcomes, and recovery paths all work without breaking resend verification.

Written by the indexing model from the issue text.