fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2)

The token was only ever consumed inside Welcome.tsx, which App renders ONLY when
there is no session. Opening the emailed link in a browser that already held a
Siftlode session posted nothing, the fragment was then stripped, and the user got
no signal at all -- the link simply did nothing. Incognito worked, which is why it
survived. Confirmation now happens in App, above that branch: signed out the outcome
still drives the auth card's banners, signed in it drives a top-of-app bar.

The entry URL is snapshotted once at import time (lib/entryUrl) instead of per
component, so no future URL writer can strip a token before whoever needs it has
read it -- that ordering race is what broke this in the first place. POST /auth/verify
now names the address it confirmed, which matters when the browser holds a session
for a different account; the same reasoning as password_reset_required already
covers the disclosure.

Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both
senders emit the fragment form, and the last query-token link expired 24h after the
0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and
the auth-card banners get role=status. The verifyOkReset copy no longer blames
admin approval, which E9.5 S1 made false.

frontend/src/App.tsx

@@ -17,6 +17,7 @@ import {
 import { notify, removeByMetaKind } from "./lib/notifications";
 import { LS, setAccountRaw } from "./lib/storage";
 import { usePref } from "./lib/usePref";
+import { useVerifyEntry } from "./lib/useVerifyEntry";
 import { useNavigation, useNavigationActions } from "./components/NavigationProvider";
 import { useFeedFilters, useFeedFiltersActions } from "./components/FeedFiltersProvider";
 import { useChannelLayout } from "./components/ChannelsProvider";
@@ -37,6 +38,7 @@ import { StateMessage } from "./components/QueryState";
 import ErrorDialog from "./components/ErrorDialog";
 import VersionBanner from "./components/VersionBanner";
 import DemoBanner from "./components/DemoBanner";
+import VerifyBanner from "./components/VerifyBanner";
 import { focusAccessRequestsTab } from "./lib/adminUsersTab";
 // The built app version, NOT imported from releaseNotes — importing anything from that module
 // pulls its whole ~900-line changelog into the eager App chunk and defeats the lazy ReleaseNotes
@@ -54,6 +56,11 @@ export default function App() {
   const { t, i18n } = useTranslation();
   const { page, channelView, ytSearch } = useNavigation();
   const { setPage, enterYtSearch } = useNavigationActions();
+  // An emailed verification link is confirmed HERE, above the signed-in/signed-out branch below, so
+  // it works in a browser that already holds a session. It used to be handled inside Welcome, which
+  // that branch never renders when signed in — the token was silently dropped. Signed out, the
+  // outcome goes to the auth card's banners; signed in, to the top-of-app bar.
+  const verifyEntry = useVerifyEntry();
   // The global feed filters live in FeedFiltersProvider (per-account persistence + the account-load
   // effect + share-link capture all moved there). App reads them to hand to <Feed> and to the
   // handlers that mutate the feed view (onShowInFeed, tag-click, the feed scrollKey).
@@ -288,7 +295,7 @@ export default function App() {
         </StateMessage>
       </div>
     );
-  if (!meQuery.data) return <Welcome />;
+  if (!meQuery.data) return <Welcome verify={verifyEntry} />;
 
   // Shown briefly while a lazy page/module chunk loads (first visit to that page only).
   const pageFallback = (
@@ -386,6 +393,7 @@ export default function App() {
             header={<Header me={meQuery.data!} onYtSearch={enterYtSearch} />}
             banners={
               <>
+                <VerifyBanner entry={verifyEntry} />
                 {meQuery.data!.is_demo && <DemoBanner />}
                 <VersionBanner onOpen={() => openReleaseNotes(FRONTEND_VERSION)} />
               </>