fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2)

The token was only ever consumed inside Welcome.tsx, which App renders ONLY when
there is no session. Opening the emailed link in a browser that already held a
Siftlode session posted nothing, the fragment was then stripped, and the user got
no signal at all -- the link simply did nothing. Incognito worked, which is why it
survived. Confirmation now happens in App, above that branch: signed out the outcome
still drives the auth card's banners, signed in it drives a top-of-app bar.

The entry URL is snapshotted once at import time (lib/entryUrl) instead of per
component, so no future URL writer can strip a token before whoever needs it has
read it -- that ordering race is what broke this in the first place. POST /auth/verify
now names the address it confirmed, which matters when the browser holds a session
for a different account; the same reasoning as password_reset_required already
covers the disclosure.

Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both
senders emit the fragment form, and the last query-token link expired 24h after the
0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and
the auth-card banners get role=status. The verifyOkReset copy no longer blames
admin approval, which E9.5 S1 made false.

frontend/src/lib/entryUrl.ts

@@ -0,0 +1,26 @@
+// The URL the app was OPENED with, captured once when this module is first imported — before any
+// component renders and before anything rewrites the address bar.
+//
+// Why a module-level snapshot rather than a `useState(() => …)` in whichever component needs it: the
+// 2026-09-02 incident was exactly this race. The nav-param mirrors mount ABOVE the lazily-loaded
+// <App>, and their mount effect replaceState'd the fragment away before AuthCard had snapshotted it,
+// so the emailed verification token was gone by the time anyone looked for it. 0.78.7 fixed that by
+// teaching urlWithParams/clearParams to carry the hash, but that leaves the guarantee resting on
+// every future URL writer remembering to do the same. Reading the entry URL once, at import time,
+// cannot lose the race no matter who mounts first or which chunk loads when.
+//
+// Secret tokens (verify, reset) ride the FRAGMENT so they never reach the server, a proxy log or a
+// Referer header (SB3); plain status flags ride the query string.
+
+export const entrySearch = new URLSearchParams(window.location.search);
+export const entryHash = new URLSearchParams(window.location.hash.replace(/^#/, ""));
+
+/** Strip the query string and fragment from the address bar, so a one-time token doesn't linger in
+ * history or get re-sent on a reload. Everything worth keeping is already in the snapshots above.
+ * ONE owner calls this (useVerifyEntry, which App mounts unconditionally) — a second caller would be
+ * harmless but makes it unclear who is responsible. */
+export function clearEntryUrl(): void {
+  if (window.location.search || window.location.hash) {
+    window.history.replaceState(null, "", window.location.pathname);
+  }
+}