Missing email verification flow (H5 from security audit)

[projectamazonph]

Problem

src/app/actions/auth.ts contains this comment:

NOTE: do NOT gate sign-in on emailVerified until a real verification flow exists (send + verify endpoint + backfill for pre-existing users). The 2026-07-15 gate locked out all users created before it while pointing at a verification email that is never sent — see docs/security/code-audit-2026-07-15.md (H5).

Currently, any user can sign up with any email address. emailVerified is set to new Date() immediately on signup, which defeats the purpose of having the field.

Impact

• No proof the user owns the email they sign up with
• Payment receipts and course access emails go to unverified addresses
• Account takeover risk if someone guesses another VA's email

Required for a real verification flow

1. Send verification email on signup (using Resend, already in the stack)
2. Verification endpoint that validates the token and sets emailVerified
3. Gate sign-in on emailVerified === true (after backfill)
4. Backfill for existing users: batch-set emailVerified for accounts created before this change, or send a mass verification email
5. Resend endpoint for users who didn't receive the first email

References

• src/app/actions/auth.ts lines ~100-110 (emailVerified gate comment)
• docs/security/code-audit-2026-07-15.md (H5)
• src/lib/email.tsx (Resend templates — verification template needed)

Severity: Required — blocks trust for payment flows