OAuth2: "email verification" enabled requires verifying the email address

Enabling `Check Email Verified: The OAuth2 site has verified the email` sends an email to the new user and makes it inactive. Having a verified email address should have the opposite effect, thus avoiding this check. It almost looks like the UI control on/off is inverted.

Start by tracing the “Check Email Verified” OAuth2 setting through the login and email-verification flow, comparing its enabled and disabled behavior. Done means an OAuth2 user with a verified email is not sent another verification email or made inactive, with regression coverage for both setting states.

Written by the indexing model from the issue text.