feat(auth): harden the signup/login flow (verification, anti-abuse, OAuth, sessions)

[dantaspaulo]

Cohesive hardening of the public signup/login surface. No new dependencies, no new tables.

Security / robustness

• Mandatory email verification with a magic link — a global EnsureEmailVerified middleware gates page navigation (non-JSON GET) until the address is confirmed. The signed verification link verifies and logs the user in, so it works even when opened on another device/browser. Social logins and invites are already verified; self-hosted skips the gate.
• Fix your email before verifying (UpdateUnverifiedEmailController) — a user who mistyped their address at signup can change it and resend the link, only while unverified.
• Close OAuth account-takeover — the Google/GitHub callback only links an existing account by email (or creates a verified one) when the provider confirmed that email: Google's OIDC email_verified claim, GitHub's /user/emails API. Otherwise it returns to login without linking.
• Password reset/change drops active sessions — reset wipes all of the user's DB sessions; changing it in settings wipes the others. An attacker with an open session no longer survives the victim's reset.
• Anti-enumeration on forgot-password — uniform response whether or not the email exists, plus a throttle.
• Anti-abuse on register — throttle:5,1, an autofill-proof honeypot (hidden contact_time, cleared on mount/autofill so it never blocks a real signup), disposable-email blocking (NotDisposableEmail, config-extensible), and a per-IP daily quota (0 disables).
• Security headers + secure session cookie — SecurityHeaders middleware (nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS in prod) and session.secure defaulting to true in production.
• Strict email validation — Email::defaults() (strict + native) so a@b, @localhost and whitespace are rejected everywhere a new email enters (register, reset, invite, email-fixup) before they bounce.

Signup UX

• 45s resend cooldown with an animated countdown on the verify screen.
• Real-time password-strength meter on register and reset, mirroring the backend rules.

Config

New config/trypost.php security.* (per-IP quota, disposable blocking, extra domains) and services.github.api (overridable GitHub API host).

Tests

RegistrationAbuseTest, OauthLinkingSecurityTest, AuthHardeningTest — 17 tests / 53 assertions covering the honeypot, disposable/quota/strict-email rules, the OAuth takeover fix, the verification gate, uniform forgot-password and session invalidation.