feat(accounts): outgoing mail over SMTP (Resend), email verification, fail-closed password reset

- mail/ module (lettre, ru/en templates), links built only from PUBLIC_BASE_URL
- migration 0006: accounts.email_verified_at, shared email_tokens table (verify + reset), existing accounts marked verified
- reset mailer no longer logs tokens; RESET_MAIL_MODE=log is dev-only and refused with COOKIE_SECURE=true; Disabled by default answers 503
- forgot-password and resend-verification do their work in a background task (no timing oracle)
- device linking requires a verified email; email_verified exposed via /me and gRPC
- gateway rate limits, SMTP_* in compose and .env.example
- frontend: verify, forgot-password, reset-password pages, verify banner, ru/en strings

backend/docker-compose.prod.yml

@@ -78,6 +78,17 @@ services:
       AVATAR_PUBLIC_BASE_URL: https://visual.loki-code.dev/api/media
       PORT: 8081
       GRPC_PORT: 50051
+      # Outgoing mail (Resend SMTP): secrets live in .env on the VPS, never
+      # in the repo. Empty SMTP_HOST keeps mail disabled (endpoints answer
+      # 503, fail-closed).
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-587}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
+      MAIL_FROM: ${MAIL_FROM:-}
+      # Link origin inside emails; must match the public site origin.
+      PUBLIC_BASE_URL: https://visual.loki-code.dev
+      MAIL_LANG: ${MAIL_LANG:-ru}
     networks: [lovisual-internal]
 
   configs-service: