users: require_verification setting is never read — unverified signups can never log in #547

UsersSettings.require_verification (default True, editable in Admin → Settings → users) is not read anywhere in the users module. Login (modules/users/users/auth_local/api.py) always refuses an unverified account with LOGIN_USER_NOT_VERIFIED, and registration always sends a verification email (manager.on_after_register → request_verify).

So an operator who turns the setting off (no SMTP, internal install) still gets self-registered users who can never sign in until an admin verifies each one by hand (PATCH /api/users/admin/<id>/verify). The register success screen still says "Check your inbox".

Fix direction: honour the setting. When it is off, mark a self-registered user verified in on_after_register and skip request_verify, and make the register page's verification notice and success screen follow it (#525 briefly gated the notice on the prop, then reverted it because login didn't follow). OAuth already provisions verified users. Add tests for both values: register → login allowed or refused.

Found by browser QA of #525.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4