fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2)

The token was only ever consumed inside Welcome.tsx, which App renders ONLY when
there is no session. Opening the emailed link in a browser that already held a
Siftlode session posted nothing, the fragment was then stripped, and the user got
no signal at all -- the link simply did nothing. Incognito worked, which is why it
survived. Confirmation now happens in App, above that branch: signed out the outcome
still drives the auth card's banners, signed in it drives a top-of-app bar.

The entry URL is snapshotted once at import time (lib/entryUrl) instead of per
component, so no future URL writer can strip a token before whoever needs it has
read it -- that ordering race is what broke this in the first place. POST /auth/verify
now names the address it confirmed, which matters when the browser holds a session
for a different account; the same reasoning as password_reset_required already
covers the disclosure.

Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both
senders emit the fragment form, and the last query-token link expired 24h after the
0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and
the auth-card banners get role=status. The verifyOkReset copy no longer blames
admin approval, which E9.5 S1 made false.

backend/tests/test_auth_session.py

@@ -157,7 +157,11 @@ def test_verifying_afterwards_lets_the_original_password_in(client, db, make_use
     verified = client.post("/auth/verify", json={"token": raw})
 
     assert verified.status_code == 200
-    assert verified.json() == {"ok": True, "password_reset_required": False}
+    assert verified.json() == {
+        "ok": True,
+        "password_reset_required": False,
+        "email": "ordering@example.com",
+    }
     assert _login(client, "ordering@example.com", "chosen at registration").status_code == 200
 
 
@@ -515,7 +519,11 @@ def test_verify_tells_a_revoked_account_that_it_needs_a_new_password(client, db,
     r = client.post("/auth/verify", json={"token": raw})
 
     assert r.status_code == 200
-    assert r.json() == {"ok": True, "password_reset_required": True}
+    assert r.json() == {
+        "ok": True,
+        "password_reset_required": True,
+        "email": "needspw@example.com",
+    }
 
 
 def test_verify_reports_no_reset_needed_for_an_intact_account(client, db, make_user):
@@ -528,4 +536,8 @@ def test_verify_reports_no_reset_needed_for_an_intact_account(client, db, make_u
     r = client.post("/auth/verify", json={"token": raw})
 
     assert r.status_code == 200
-    assert r.json() == {"ok": True, "password_reset_required": False}
+    assert r.json() == {
+        "ok": True,
+        "password_reset_required": False,
+        "email": "intact@example.com",
+    }