feat: email verification + delete confirmation + smtp/cors/prod hardening

api/prisma/migrations/20260217000000_email_token_enum_used/migration.sql

@@ -0,0 +1,6 @@
+-- Harden email token lifecycle (used marker + lookup index)
+ALTER TABLE "EmailToken"
+ADD COLUMN IF NOT EXISTS "usedAt" TIMESTAMP(3);
+
+CREATE INDEX IF NOT EXISTS "EmailToken_userId_type_expiresAt_idx"
+ON "EmailToken"("userId", "type", "expiresAt");