Security: gate sessions on verified email (opt-in)

Backlog §2.10: registration issued a live session and email_verified_at was
written but never read, so an unverified user had full access and there was no
switch to require verification.

Add REQUIRE_EMAIL_VERIFICATION (default false). When true:
- resolve_session_user returns None for a user whose email_verified_at is null —
  the single read-side gate covering every authenticated request, incl. the
  session minted at registration.
- login raises 403 ("email not verified") instead of issuing a useless token.

Default false on purpose: self-hosts without SMTP, and accounts created before
this gate existed (email_verified_at null), must not be locked out. Operators
enable it once mail works and accounts are verified. Documented in .env.example.

Tests: default-off keeps unverified accounts working; on → register's session
won't resolve (401), login is 403, and after verify-email both work. 75 passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

deploy/.env.example

@@ -46,6 +46,9 @@ COOKIE_SECURE=false
 APP_BASE_URL=http://localhost
 # Mailer: 'console' logs links to stdout (dev); 'smtp' uses the SMTP settings below.
 MAILER=console
+# Require a verified email before an account has an active session. Leave false
+# until SMTP works and existing accounts are verified, or you will lock users out.
+REQUIRE_EMAIL_VERIFICATION=false
 
 # --- Email (SMTP) — wired in a later phase ---
 SMTP_HOST=