Email verification for new users

New users, whether added by their own registration or through the admin interface, should be required to verify their email address before being able to use their account.

That flow would probably look something like:
- User creation triggers sending an expiring email verification link to the user
- User follows the link and authenticates upon making the request to the verification URL
- If URL matches user and user authenticates, a verification is created for that user

Endpoint /api/users/verify/{code}:
- matches the code to an active, incomplete verification
- updates the verification by setting it's `completed` and `completed_at` fields.