Verify

Single-use verify endpoint.

• Hash the incoming token (we never store cleartext).
• Look up in Redis first (sub-ms), Postgres second.
• On hit + unexpired: create the user, issue a default API key, delete the signup_attempt row + Redis key, and render the one-shot HTML page with the cleartext key.
• Repeat signups for the same email are tolerated (idempotent in G-016); the user row already exists, just attach another default key. (Avoids the "I lost my key, can't sign back in" footgun.)