Resend Verification

Mail a fresh confirmation token to the signed-in account's address.

Registration was the only place that ever sent one, which left an unverified account with nothing to do but hunt for a mail that may be days old — and signing in again does not help, since login never asked for verification in the first place. Anything that locks a viewer out on is_email_verified needs this to point at.

Deliberately NOT the enumeration-proof shape forgot-password uses: the caller is already authenticated, so there is no address to confirm or deny the existence of, and the honest 429 is worth more than a fake 200. The address is the account's own — never taken from the request — so this cannot be turned into a mailer for someone else's inbox.