Accounts: the owner can verify a newcomer's email, and the page says when mail is off #823

Follow-up to #710 and #682, both now on main.

With no mail configured (today's live forge), a newcomer cannot prove their address, so nothing they do may create or cost until the owner says so. This adds that word.

• /settings/accounts shows each account's email standing ("Email not verified"). An unproven person gets a Verify email button. When mail is off, the page says so plainly and links to the MAIL_SMTP_URL / MAIL_FROM secrets that turn it on. mailConfigured() asks the secret names only and opens nothing.
• POST /api/v1/admin/accounts/:username/verify does the same for a script or agent (admin only; others get 404). It refuses an agent (agents are never held back) and a removed account. GET /api/v1/admin/accounts gains verified.
• The audit records account.email_verified with by: "owner".

Tests (test/accounts.test.ts, 16): an unproven newcomer is refused repo creation; a non-admin cannot verify it; the list says unverified; the page shows the button and the mail notice; the owner verifies it and it creates at once; the event is recorded; verifying an agent is refused. Gate run under the lock; the five cross tests, verify-email, here-manifest and outsiders-switch pass on main 7c68da2.

🤖 Generated with Claude Code