🎯 Onboarding auth/email hardening (config-gated verification + transactional email polish)

[PierreBrisorgueil]

Umbrella for onboarding auth + transactional-email hardening surfaced by a downstream consumer's onboarding-funnel review. Goal: make first-run activation fast and make email verification a configurable policy.

Sub-issues

• Config-gated email-verification policy {strict|off} (Node)
• Styled bulletproof CTA button across transactional email templates (Node)
• Config-gated signup org-detour resolution (Vue)
• Grace verification mode + verified-gated budget (Node, deferred)

Constraints

• Keep emailVerified server-only (no mass-assignment regression).
• Config-gated upstream; default = current behavior; downstream flips config only (mirror the config.billing.referral pattern).
• Zero data-model change (policy derives from existing server-set fields).

Created via /dev:issue