feat: email verification + delete confirmation + smtp/cors/prod hardening

.env.example

@@ -2,9 +2,11 @@
 NODE_ENV=development
 PORT=8080
 CORS_ORIGIN=http://localhost:5173
+CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,https://skymoneybudget.com
 AUTH_DISABLED=false
 SEED_DEFAULT_BUDGET=false
 ROLLOVER_SCHEDULE_CRON=0 6 * * *
+APP_ORIGIN=http://localhost:5173
 
 # Database (app runtime)
 POSTGRES_DB=skymoney
@@ -21,3 +23,14 @@ ADMIN_DATABASE_URL=postgres://postgres:change-me@127.0.0.1:5432/postgres
 JWT_SECRET=replace-with-32+-chars
 COOKIE_SECRET=replace-with-32+-chars
 COOKIE_DOMAIN=skymoneybudget.com
+
+# Email (verification + delete confirmation)
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_REQUIRE_TLS=true
+SMTP_TLS_REJECT_UNAUTHORIZED=true
+SMTP_USER=apikey-or-username
+SMTP_PASS=change-me
+EMAIL_FROM=SkyMoney <support@skymoneybudget.com>
+EMAIL_BOUNCE_FROM=bounces@skymoneybudget.com
+EMAIL_REPLY_TO=support@skymoneybudget.com