Resend Verification

Re-send the signup verification link.

The post-signup screen's "Resend verification email" CTA. The existing /send-verification-email endpoint can't serve it — that one requires the verification TOKEN, which the browser never sees.

Enumeration-safe, mirroring /password-reset/request: ALWAYS returns the same success payload whether or not the address exists or is already verified, so an attacker can't use it to discover accounts. Rate-limited by the shared auth limiter so it can't be used to spam an inbox either. Mints a FRESH token (and expiry) rather than resending the old one, so a resend also rescues someone whose original link has expired.