[codex] bypass email verification for signup

[study8677]

Summary

Temporarily disables the email verification gate by default so signup returns an authenticated session immediately.

Details

• Adds OPENCMO_EMAIL_VERIFICATION_ENABLED; verification is only required when it is set to 1, true, yes, or on.
• Marks new users verified and returns a normal auth payload when verification is disabled.
• Allows existing unverified users to log in while verification is disabled, marking them verified during login.
• Keeps the existing verification endpoints and tests available for re-enabling later.
• Updates frontend signup handling to accept either the old needs_verification response or the direct auth payload.

Validation

• PYTHONPATH=src /Users/fanjingwen/Projects/OpenCMO/.venv/bin/python -m pytest tests/test_email_verification.py tests/test_trial_platform.py
• PYTHONPATH=src /Users/fanjingwen/Projects/OpenCMO/.venv/bin/python -m ruff check src/opencmo/web/app.py tests/test_email_verification.py tests/test_trial_platform.py
• cd frontend && npm run build