feat(accounts): outgoing mail over SMTP (Resend), email verification, fail-closed password reset

- mail/ module (lettre, ru/en templates), links built only from PUBLIC_BASE_URL
- migration 0006: accounts.email_verified_at, shared email_tokens table (verify + reset), existing accounts marked verified
- reset mailer no longer logs tokens; RESET_MAIL_MODE=log is dev-only and refused with COOKIE_SECURE=true; Disabled by default answers 503
- forgot-password and resend-verification do their work in a background task (no timing oracle)
- device linking requires a verified email; email_verified exposed via /me and gRPC
- gateway rate limits, SMTP_* in compose and .env.example
- frontend: verify, forgot-password, reset-password pages, verify banner, ru/en strings

backend/.env.example

@@ -32,3 +32,20 @@ DOWNLOADS_DIR=downloads
 # configs-service
 CONFIGS_DATABASE_URL=postgres://lovisual:lovisual@localhost:5432/configs_db
 CONFIGS_PORT=8082
+# --- outgoing mail (accounts-service) ---
+# Empty SMTP_HOST = mail switched off: /auth/forgot-password answers 503 and
+# verification emails are skipped (fail-closed). Resend: host smtp.resend.com,
+# user "resend", password = API key. 587 = STARTTLS (default), 465 = implicit TLS.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+# Sender mailbox shown to recipients, e.g. LoVisual <noreply@loki-code.dev>
+MAIL_FROM=
+# The only origin email links may carry, e.g. https://visual.loki-code.dev
+PUBLIC_BASE_URL=
+# Email template language: ru (default) or en
+MAIL_LANG=ru
+# Development-only logging mailer (prints NO tokens): RESET_MAIL_MODE=log.
+# Refused at startup when COOKIE_SECURE=true; tests use the queue instead.
+RESET_MAIL_MODE=