Implement email verification for new users

[anxkhn]

Problem Description

Users can register without verifying their email address, allowing fake or incorrect emails.

Context

Email verification ensures users own the email address they provide, reducing spam and enabling password reset functionality.

Steps to Reproduce

1. Register with any email (real or fake)
2. Account is immediately active without verification

Expected Behavior

Users should verify their email before account activation.

Actual Behavior

Accounts are activated immediately without email verification.

Files to Investigate

• `app/controllers/registrations_controller.rb`
• `app/models/user.rb` - Add verified column
• Create mailer for verification email

Acceptance Criteria

• Add verified boolean column to users table
• Send verification email on registration
• Require verification before login
• Add resend verification option
• All existing tests still pass

Suggested Approach

Use a verification token with expiry, send email with verification link, mark user as verified when clicked.

Difficulty: Hard

Estimated time: 3-6 hours
Prerequisites: ActionMailer, authentication flows
Learning outcomes: Email verification patterns, token-based authentication