Passkeys, part 2: sign-up takes a passkey and an email, no new password-only accounts, and a verified email recovers #1618

Replaces the rest of #667.

Done looks like

• [ ] Sign-up registers a passkey and an email address. No path (web, API or terminal) creates a new account with only a password.
• [ ] Existing password accounts still sign in, and Settings invites them to add a passkey. A code comment says when password sign-in can be removed.
• [ ] A verified email gets a time-limited, single-use link that lets the person register a new passkey. An expired or reused link is refused.
• [ ] Tests cover passkey sign-up, the refusal of password-only sign-up, recovery, and expired and reused links. Each new test file is listed in GATE.

Files: the sign-up action and page, the verify-email module, test/.

Parked by the crew: the check failed ("migrations are additive across a roll > the release record is newest first and never ahead of the schema") and the decider saw no point in another try (pull #1891 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("/boards > a panel keeps its chart and series: chosen in the form, saved in the file, drawn on the board") and the decider saw no point in another try (pull #1960 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("migrations are additive across a roll > the release record is newest first and never ahead of the schema") and the decider saw no point in another try (pull #1891 closed)
2. the check failed ("/boards > a panel keeps its chart and series: chosen in the form, saved in the file, drawn on the board") and the decider saw no point in another try (pull #1960 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1996 (sign-up takes a passkey and an email; no password-only accounts) and #1997 (a verified email's single-use link registers a new passkey). Pulls #1891 and #1960 both went red only on main's own faults (the release record, fixed in 39e98bc9; the boards test, fixed in 43bf1e57). The two halves touch different files, so each fits in one run and neither waits for the other.