feat: users.email_verified_at records a proved address (mail activation, reset code)

- additive migration 202610210001_add_users_email_verified_at (ADD COLUMN IF NOT EXISTS, no backfill, no-op rollback)
- User.EmailVerifiedAt (json:"-", not fillable)
- VerifyActivationCode and ResetPassword stamp it in the write that activates or stores the password

controllers/api_controller.go

@@ -329,10 +329,14 @@ func ResetPassword(app *backpack.App) http.HandlerFunc {
 			writeOpaque500(w)
 			return
 		}
+		// The reset code was mailed to the account's address, so the write
+		// that stores the new password also records the proof of that
+		// address (D-27). A reset that fails here records nothing.
 		now := time.Now()
 		if err := gdb.WithContext(r.Context()).Model(&models.User{}).Where("id = ?", user.ID).Updates(map[string]any{
 			"password":           hashed,
 			"tokens_valid_after": now,
+			"email_verified_at":  now,
 		}).Error; err != nil {
 			writeOpaque500(w)
 			return