* security: require verified email for client signups * security: load verified-email auth guard * test: include auth security guard in deploy checks * test: guard verified-email signup flow * security: remove client-controlled email autoconfirm triggers