Passkeys, part 2b: a verified email gets a single-use, 30-minute link that registers a new passkey #1997

Replaces the recovery half of #1618.

Done looks like:

• [ ] A person with a verified email asks for recovery and gets a link that lasts 30 minutes and works once. Opening it lets them register a new passkey and signs them in. It builds on src/actions/verify.ts, not on a second token store.
• [ ] An expired, reused or unknown link is refused with one plain sentence. Asking for an address that has no account answers exactly as one that does.
• [ ] The request is rate-limited per address and per source, and stores only a hash of the token.
• [ ] Tests in a new file named in GATE: recovery round-trip; expired, reused and forged links refused; the same answer for an unknown address.

Files: src/actions/verify.ts, the passkeys page, a new test. Start from today's main, at or after c889df7b. Earlier tries went red on "the release record is newest first" and "/boards > a panel keeps its chart and series". Both were main's own faults, fixed in 39e98bc9 and 43bf1e57, and the builder did not cause them. Name a new migration src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts (see 20261015230000-a-domain-drill.ts), never by number, and do not edit src/core/releases.json by hand. Before pushing, run bun x tsc --noEmit, the tests this touches, the schema-migrations and schema-additive tests if you add a migration, and test/check-list.test.ts. Name every new test file in GATE in scripts/gate.ts in the same commit. No test bounds a request or a spawn by wall-clock time. A test that goes red in this pull is fixed in this pull.

Parked by the crew: the check failed ("reserved names > every top-level page of the forge is a reserved name") and the decider saw no point in another try (pull #2004 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.