Feature: Email verification and password reset workflows with signed one-time tokens

## Why
The current module has no email ownership verification and no secure password recovery flow. Both are core capabilities for production-ready account lifecycle management.

## Proposal
Add two lifecycle workflows:
1. Email verification after registration/email change
2. Password reset via one-time, short-lived signed tokens

## Scope
- Verification token generation + consume endpoint
- Password reset request + confirm endpoints
- Token hashing/storage with TTL and one-time-use semantics
- Pluggable email provider interface (SMTP adapter + mock provider)

## API Additions (proposed)
- `POST /auth/verify-email/request`
- `POST /auth/verify-email/confirm`
- `POST /auth/password-reset/request`
- `POST /auth/password-reset/confirm`

## Technical Notes
- Do not reveal account existence in reset request response
- Invalidate all active sessions after successful password reset
- Add resend throttling and abuse protection per email/IP

## Acceptance Criteria
- New accounts can be flagged as `emailVerified=false` until confirmed
- Password reset tokens are one-time and expire predictably
- Successful reset revokes all sessions and requires re-login
- Email provider is swappable for tests/dev/prod
- End-to-end tests validate token expiration, replay prevention, and abuse throttling

## Out of Scope
- Marketing email templates system
- Account invitation flows