Email confirmation, change email/password, show/hide passwords

- Sign-up emails a confirmation link (24h); unconfirmed accounts see a
  banner on the web with "send it again", and status in Settings.
- Change email (needs the password): the new address gets a confirmation
  link and only replaces the old one once clicked; the old address gets a
  heads-up with a reset-password link. Pending changes can be cancelled.
- Change password (needs the current one): signs out other sessions.
- Password fields have Show/Hide on web and mobile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/dto.ts

@@ -21,6 +21,9 @@ export interface UserSummaryDTO {
 
 export interface MeDTO extends UserSummaryDTO {
   email: string;
+  emailVerified: boolean;
+  /** A new address waiting to be confirmed (the link was sent there). */
+  pendingEmail: string | null;
   bio: string | null;
   preferredService: StreamingService | null;
   role: 'user' | 'admin';