feat(auth): implement email verification flow

[portableDD]

Summary

Implements the full email verification flow described in the issue.
Users receive a verification link on registration and cannot log in
until they click it. Invalid or expired tokens are rejected with 400.

Changes

src/models/User.model.js
Renamed verificationToken → emailVerificationToken and
verificationTokenExpires → emailVerificationExpires to match the
issue spec exactly.

src/controllers/auth.controller.js

• register: uses new field names; sends verification email via the
  existing (previously unwired) email.service + template; email
  failure is caught and logged without blocking registration; raw token
  removed from the response body
• verifyEmail (new): single-query expiry check with $gt: new Date();
  sets isVerified: true and nulls token fields; returns 400 for any
  non-matching query result
• login: unchanged — !user.isVerified guard already enforces the
  acceptance criterion

src/routes/auth.routes.js
Added GET /api/auth/verify-email/:token → verifyEmail

src/__tests__/auth.verify.test.js (new)
Covers: success path (field mutations + query shape), invalid token,
expired token, and re-use of an already-cleared token.

src/__tests__/auth.register.test.js (new)
Covers: success path with email send assertion, token field validation
(64-char hex, 24h expiry), duplicate email, Joi validation failures,
and SMTP failure tolerance.

Acceptance criteria

• Users can verify their email via GET /api/auth/verify-email/:token
• Token generated with crypto.randomBytes(32) on registration
• emailVerificationToken and emailVerificationExpires saved on User
• Returns 400 for invalid or expired tokens
• Unverified users cannot log in (enforced by existing !isVerified guard)

closes #19