Render the verify-email confirmation page.

DOES NOT consume the token. Email security scanners (Microsoft Safe Links, Mimecast, Proofpoint, etc.) pre-fetch every URL in inbound mail; if this endpoint consumed the token, scanners would burn it before the real user ever clicks.

The page presents a button that POSTs to /api/verify-email, which is where the actual consumption happens. Real human action required.