No email verification

[lisiur]

emailVerified set false, never enforced; no verify endpoint in routes/auth/.

Fix: Enforce ownership beyond uniqueness (add a verification flow).