fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2)

The token was only ever consumed inside Welcome.tsx, which App renders ONLY when
there is no session. Opening the emailed link in a browser that already held a
Siftlode session posted nothing, the fragment was then stripped, and the user got
no signal at all -- the link simply did nothing. Incognito worked, which is why it
survived. Confirmation now happens in App, above that branch: signed out the outcome
still drives the auth card's banners, signed in it drives a top-of-app bar.

The entry URL is snapshotted once at import time (lib/entryUrl) instead of per
component, so no future URL writer can strip a token before whoever needs it has
read it -- that ordering race is what broke this in the first place. POST /auth/verify
now names the address it confirmed, which matters when the browser holds a session
for a different account; the same reasoning as password_reset_required already
covers the disclosure.

Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both
senders emit the fragment form, and the last query-token link expired 24h after the
0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and
the auth-card banners get role=status. The verifyOkReset copy no longer blames
admin approval, which E9.5 S1 made false.

frontend/src/i18n/locales/en/header.json

@@ -55,5 +55,11 @@
     "updated": "Updated to v{{version}} — see what's changed.",
     "releaseNotes": "Release notes",
     "dismiss": "Dismiss"
+  },
+  "verify": {
+    "confirmed": "Email address confirmed.",
+    "confirmedNamed": "Email address confirmed — {{email}}.",
+    "invalid": "That verification link is no longer valid — it has expired or was already used.",
+    "reset": "The password this account registered with was cleared for security; set a new one before signing in."
   }
 }

frontend/src/i18n/locales/en/welcome.json

@@ -86,7 +86,7 @@
     "forgotDone": "If that email has an account, we've sent a reset link. Check your inbox.",
     "resetDone": "Your password has been set — you can sign in now.",
     "verifyOk": "Email confirmed. Once an admin approves your account, you can sign in.",
-    "verifyOkReset": "Email confirmed. Your account was approved before you confirmed it, so the password you registered with was cleared for security — choose a new one to sign in.",
+    "verifyOkReset": "Email confirmed. The password this account registered with had been cleared for security — choose a new one to sign in.",
     "verifyOkResetCta": "Set a new password",
     "verifyInvalid": "That verification link is invalid or has expired.",
     "resendCta": "Send a new link",

frontend/src/i18n/locales/hu/header.json

@@ -55,5 +55,11 @@
     "updated": "Frissítve a(z) v{{version}} verzióra — nézd meg, mi változott.",
     "releaseNotes": "Verziójegyzék",
     "dismiss": "Elvetés"
+  },
+  "verify": {
+    "confirmed": "Megerősítettük az e-mail-címedet.",
+    "confirmedNamed": "Megerősítettük az e-mail-címedet — {{email}}.",
+    "invalid": "Ez a megerősítő link már nem érvényes — lejárt, vagy már felhasználták.",
+    "reset": "A fiók regisztrációkori jelszavát biztonsági okból töröltük; belépés előtt állíts be újat."
   }
 }

frontend/src/i18n/locales/hu/welcome.json

@@ -86,7 +86,7 @@
     "forgotDone": "Ha ehhez az e-mailhez tartozik fiók, elküldtük a visszaállító linket. Nézd meg a postafiókod.",
     "resetDone": "A jelszavad be van állítva — most már beléphetsz.",
     "verifyOk": "E-mail megerősítve. Amint egy admin jóváhagyja a fiókodat, beléphetsz.",
-    "verifyOkReset": "E-mail megerősítve. A fiókodat még a megerősítés előtt jóváhagyták, ezért biztonsági okból töröltük a regisztrációkor megadott jelszavadat — válassz újat a belépéshez.",
+    "verifyOkReset": "E-mail megerősítve. A fiók regisztrációkori jelszavát biztonsági okból korábban töröltük — válassz újat a belépéshez.",
     "verifyOkResetCta": "Új jelszó beállítása",
     "verifyInvalid": "Ez a megerősítő link érvénytelen vagy lejárt.",
     "resendCta": "Új link küldése",