[AUTH-002] Auth: User registration & email verification

## Overview
Allow new users to create an account. Email verification is required before certain features (checkout, reviews) are accessible.

## Acceptance Criteria
- [ ] Registration form: first name, last name, email, password, confirm password
- [ ] Client-side validation: email format, password strength (8+ chars, 1 number, 1 special)
- [ ] `POST /api/auth/register` creates user in pending state
- [ ] Verification email sent automatically on registration
- [ ] `GET /api/auth/verify/:token` activates the account
- [ ] Resend verification email option on login screen for unverified users
- [ ] Duplicate email shows friendly error (do not leak user existence)

## Depends On
- #5 AUTH-001 — auth service and token infrastructure must exist

## Blocks
- #7 AUTH-003 (password reset links to registration UX)
- #10 ACC-006 (profile uses registration data)