Email confirmation, change email/password, show/hide passwords

- Sign-up emails a confirmation link (24h); unconfirmed accounts see a
  banner on the web with "send it again", and status in Settings.
- Change email (needs the password): the new address gets a confirmation
  link and only replaces the old one once clicked; the old address gets a
  heads-up with a reset-password link. Pending changes can be cancelled.
- Change password (needs the current one): signs out other sessions.
- Password fields have Show/Hide on web and mobile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/web/src/app/verify-email/page.tsx

@@ -0,0 +1,60 @@
+'use client';
+
+import Link from 'next/link';
+import { useSearchParams } from 'next/navigation';
+import { Suspense, useEffect, useRef, useState } from 'react';
+import { client, useMe } from '@/lib/api';
+
+export default function VerifyEmailPage() {
+  return (
+    <Suspense>
+      <VerifyEmail />
+    </Suspense>
+  );
+}
+
+function VerifyEmail() {
+  const token = useSearchParams().get('token');
+  const { me, mutate } = useMe();
+  const [state, setState] = useState<{ ok: true; email: string } | { ok: false; error: string } | null>(null);
+  const started = useRef(false);
+
+  useEffect(() => {
+    if (!token || started.current) return; // links work once; don't send twice in dev's double effects
+    started.current = true;
+    client
+      .verifyEmail(token)
+      .then((res) => {
+        setState(res);
+        void mutate();
+      })
+      .catch((err: Error) => setState({ ok: false, error: err.message }));
+  }, [token, mutate]);
+
+  if (!token) return <Result title="Link incomplete" body="Open the link straight from the email." />;
+  if (!state) return <Result title="Confirming…" body="One moment." />;
+  if (!state.ok) {
+    return (
+      <Result title="Couldn't confirm" body={state.error}>
+        {me && <p className="muted">You can send a new link from the banner at the top, or from Settings.</p>}
+      </Result>
+    );
+  }
+  return (
+    <Result title="Email confirmed ✓" body={`${state.email} is confirmed for your musicshare account.`}>
+      <Link href={me ? '/' : '/login'} className="btn btn-primary">
+        {me ? 'Go to your feed' : 'Log in'}
+      </Link>
+    </Result>
+  );
+}
+
+function Result({ title, body, children }: { title: string; body: string; children?: React.ReactNode }) {
+  return (
+    <div className="card form narrow">
+      <h1>{title}</h1>
+      <p>{body}</p>
+      {children}
+    </div>
+  );
+}