Scope: on signup send a verification email with a single-use token (VERIFY#{token} w/ TTL); GET /api/auth/verify?token= flips emailVerified=true. Resend endpoint. Gate sensitive actions on verified email.
Done when: unverified users get a clear banner + can verify via the emailed link.