feat(auth): email verification with magic-link auto-login

[Dandiggas]

Summary

Closes #16. Replaces the current register → redirect-to-login flow with a mandatory-verify + magic-link-login flow:

1. User registers → account created unverified, email sent via SendGrid (console backend in dev).
2. User sees a dedicated "check your email" screen with a resend affordance.
3. User clicks the link on any device → /auth/verify/[key] page POSTs to a new verify-and-login endpoint that confirms the email and issues a DRF token in one round-trip.
4. Frontend stores the token + userId and redirects to /dashboard. One click from inbox to practicing.

What's in this PR

Backend

• New POST /api/v1/dj-rest-auth/registration/verify-and-login/ endpoint wrapping allauth's EmailConfirmation.confirm() + issuing a DRF Token in one response (same shape as /login/).
• CustomAccountAdapter routes confirmation URLs to ${FRONTEND_URL}/auth/verify/<key>.
• ACCOUNT_EMAIL_VERIFICATION = "mandatory" flips the gate so unverified accounts can't log in. ACCOUNT_EMAIL_SUBJECT_PREFIX = "[The Shed] " replaces Django's default [example.com] prefix.
• SendGrid SMTP gated on SENDGRID_API_KEY. Console backend is the dev default — emails print to the web logs.
• Startup check raises ImproperlyConfigured if FRONTEND_URL is missing when DEBUG=False.
• Data migration 0002_grandfather_existing_users idempotently marks pre-existing EmailAddress rows verified=True, primary=True, creating rows for users who don't have one. Case-insensitive email matching, demotes stale primaries, and normalizes CustomUser.email to lowercase so dj-rest-auth's case-sensitive login filter matches the verified row. Forward-only (reversing would re-unverify everyone). Lands before the mandatory-verify gate so existing users aren't locked out.
• Email templates (subject/text/HTML) overridden under templates/account/email/ — single CTA button, email-client-safe inline CSS.

Frontend

• New /auth/check-email?email=... post-register screen with manual resend button.
• New /auth/verify/[key] callback page with 6 render states: loading, success (auto-redirect), expired (resend form), invalid (resend form), already-verified (go-to-login link), error (retry). aria-live on all status regions.
• RegisterPage now redirects to /auth/check-email?email=... on success.
• LoginPage detects unverified-email error, shows inline banner, auto-fires resend once on first arrival (guarded with useRef), exposes a manual "Resend" button. Only fires the auto-resend when the typed username is email-shaped.

Test coverage

Layer	Count	Notes
Backend	78 tests	7 grandfather (idempotency, multi-primary, mixed-case, CustomUser normalization), 2 adapter, 7 settings + 3 startup-check, 8 verify (all 4 status codes including HMAC-expired path), + 53 pre-existing
Frontend	58 tests	4 check-email, 5 verify callback (every render state), 1 RegisterPage redirect, 3 LoginPage unverified, + 45 pre-existing
Typecheck	✅	npx tsc --noEmit clean

Plus full end-to-end integration smoke against the live backend (register → capture activate_url → POST verify-and-login → confirm 200 + token; re-click same key → 409 already_verified; login with verified user → token; dan grandfather check still passes).

Deploy checklist (Railway)

Before merging, set these env vars on the backend Railway service:

• SENDGRID_API_KEY=<your-SendGrid-Mail-Send-key> — created via SendGrid Settings → API Keys → Restricted Access (Mail Send only).
• DEFAULT_FROM_EMAIL=dandiggasmusic@gmail.com — the address verified via SendGrid Settings → Sender Authentication → Single Sender Verification.
• FRONTEND_URL=https://<your-frontend>.railway.app — must be the public frontend URL, no trailing slash. The startup check will refuse to boot the container without this when DEBUG=False.

Frontend service (should already be set from the metronome PR):

• NEXT_PUBLIC_API_URL=https://<your-backend>.railway.app/api/v1

Post-deploy smoke

• Register a throwaway account on the live URL.
• Confirm the email arrives from SendGrid (not console), From: dandiggasmusic@gmail.com, Subject: [The Shed] Verify your email and get into The Shed.
• Click the link on a different device. Expect auto-login + /dashboard.
• Try logging in with that user normally — should succeed (token-based login works post-verify).

Known follow-ups (not this PR)

• Rate-limit /registration/resend-email/ and /verify-and-login/ #45 — Rate-limit /verify-and-login/ and /resend-email/. Not a launch blocker with unguessable HMAC keys + low volume, but should land before the app has real traffic.
• Domain authentication on SendGrid (for better deliverability) once a custom domain is available. Current single-sender setup ships via SendGrid's shared IPs.
• Post-verify onboarding UX on /dashboard for day-zero users (empty state polish).

🤖 Generated with Claude Code