Confirm an email address with a PocketBase verification token

No authentication. Calls users.confirmVerification(token) with an unauthenticated PocketBase client (POCKETBASE_URL); no superuser client is involved. A PocketBase 404 or a token field error answers 400; any other PocketBase failure answers 500 with the PocketBase field errors in details. A truthy non-string token (e.g. a number) is not rejected up front and ends in 500 Failed to verify email. A non-JSON or null body answers 500 Internal server error.