Feature: Email verification and password reset workflows with signed one-time tokens

[hoangsonww]

Why

The current module has no email ownership verification and no secure password recovery flow. Both are core capabilities for production-ready account lifecycle management.

Proposal

Add two lifecycle workflows:

1. Email verification after registration/email change
2. Password reset via one-time, short-lived signed tokens

Scope

• Verification token generation + consume endpoint
• Password reset request + confirm endpoints
• Token hashing/storage with TTL and one-time-use semantics
• Pluggable email provider interface (SMTP adapter + mock provider)

API Additions (proposed)

• POST /auth/verify-email/request
• POST /auth/verify-email/confirm
• POST /auth/password-reset/request
• POST /auth/password-reset/confirm

Technical Notes

• Do not reveal account existence in reset request response
• Invalidate all active sessions after successful password reset
• Add resend throttling and abuse protection per email/IP

Acceptance Criteria

• New accounts can be flagged as emailVerified=false until confirmed
• Password reset tokens are one-time and expire predictably
• Successful reset revokes all sessions and requires re-login
• Email provider is swappable for tests/dev/prod
• End-to-end tests validate token expiration, replay prevention, and abuse throttling

Out of Scope

• Marketing email templates system
• Account invitation flows