Verify email address using the one-time token sent on registration.

Consume a plaintext verification token and mark the user's email as verified.

Atomic implementation (M2 fix): uses a single UPDATE … RETURNING statement to prevent race conditions on concurrent double-verify requests. Exactly one call wins; subsequent calls with the same token receive 409.

Rate-limited to 10 req/min per IP via _AUTH_STRICT_PATHS (C2 spec). GET variant with /{token} path NOT included in W2 — only POST here. Frontend POSTs on load of /verify-email?token=… (Lane D4 post-C2 merge).

Error codes (ADR-014 wire format {"detail": {"error": "..."}}): 404 token_not_found — hash not in table. 410 token_expired — token found but past expires_at. 409 token_already_used — token was already consumed. 422 validation_failed — token field missing or too long.