Make Email Verification APIs State-Driven

A practical design for explicit email-verification states, safe retries, PostgreSQL constraints, and REST API responses that clients can trust.