feat(v1.1.8): email verification flow (migration 0028 + SDK)

migration 0028: app_user_email_verifications table — token_hash PK,
app_id + user_id FKs cascading, expires_at, consumed_at. Single-use
via atomic UPDATE WHERE consumed_at IS NULL.

UsersServiceImpl gains:
  * verifications: Arc<dyn AppUserVerificationRepo>
  * email: Arc<dyn EmailService>

users::send_verification_email(user_id, opts) mints a 32-byte token,
stores SHA-256(token), and calls EmailService::send with the body
template's {link} placeholder substituted by link_base + ?token=raw.
EmailError::NotConfigured propagates as UsersError::EmailNotConfigured
so scripts already handling email-disabled mode (v1.1.7 email::send)
don't need new branches.

users::verify_email(token) atomically consumes the one-shot token via
the verifications repo, marks the user's email_verified_at = NOW(),
and emits a "users::email_verified" event for future triggers.

Internal email send uses a synthesized SdkCallCx with principal=None
so the email-service AppEmailSend authz check is skipped (the
users::* surface has already gated on AppUsersWrite — the internal
hop isn't the script's direct call). Documented in HANDBACK §7.

EmailTemplateOpts now requires `from` (the v1.1.7 email service needs
an envelope sender). The brief example omitted it; deviation logged
in HANDBACK §7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud/src/lib.rs

@@ -22,7 +22,8 @@ use picloud_manager_core::{
     OutboxRepo, PostgresAbandonedRepo, PostgresAdminSessionRepository, PostgresAdminUserRepository,
     PostgresApiKeyRepository, PostgresAppDomainRepository, PostgresAppMembersRepository,
     PostgresAppRepository, PostgresAppSecretsRepo, PostgresAppUserRepository,
-    PostgresAppUserSessionRepository, PostgresDeadLetterRepo, PostgresDeadLetterService,
+    PostgresAppUserSessionRepository, PostgresAppUserVerificationRepo, PostgresDeadLetterRepo,
+    PostgresDeadLetterService,
     PostgresDocsRepo, PostgresExecutionLogRepository, PostgresExecutionLogSink, PostgresKvRepo,
     PostgresOutboxRepo, PostgresPubsubRepo, PostgresRouteRepository, PostgresScriptRepository,
     PostgresSecretsRepo, PostgresTopicRepo, PostgresTriggerRepo, PrincipalResolver,
@@ -250,9 +251,13 @@ pub async fn build_app(
     // `users::*` namespace and the admin /apps/{id}/users HTTP surface.
     let app_users_repo = Arc::new(PostgresAppUserRepository::new(pool.clone()));
     let app_user_sessions_repo = Arc::new(PostgresAppUserSessionRepository::new(pool.clone()));
+    let app_user_verifications_repo =
+        Arc::new(PostgresAppUserVerificationRepo::new(pool.clone()));
     let users: Arc<dyn UsersService> = Arc::new(UsersServiceImpl::new(
         app_users_repo.clone(),
         app_user_sessions_repo.clone(),
+        app_user_verifications_repo.clone(),
+        email.clone(),
         authz.clone(),
         events.clone(),
         UsersServiceConfig::from_env(),