Add email verification

[binwiederhier]

Verified email recipients

Adds email address verification for outgoing email notifications, gated behind a new smtp-sender-verify config flag (default false).

What it does

When smtp-sender-verify: true:

• Anonymous users cannot send email notifications
• Authenticated users must verify email addresses via a code sent to their inbox before those addresses can be used
• Users can pass X-Email: yes (or true/1) to send to their first verified address
• The "Email addresses" section appears in the web app account settings for adding/removing verified addresses

When smtp-sender-verify is unset or false, email sending works exactly as before — any user can send to any address. The feature is fully backwards compatible.

Changes

New mail package (mail/sender.go): SMTP email sending with SendRaw/Send methods, in-memory verification code storage with background expiry, and Close() for cleanup.

Database: New user_email table (SQLite + PostgreSQL migrations v6→v7) with Emails()/AddEmail()/RemoveEmail() on the user manager.

Server: Three new API endpoints (verify, add, delete email), convertEmailAddress() that enforces verification when the flag is on, ensureEmailsEnabled middleware, rate limiting verification emails against the user's email quota. smtpSender now delegates to mail.Sender.SendRaw() instead of duplicating SMTP auth logic.

Web app: Emails component (mirrors phone numbers), AddEmailDialog with verification code flow, EmailVerificationCodeInvalidError for specific error handling. Section only visible when enable_email_verify is true in the server config.

Config: smtp-sender-verify bool flag with CLI flag, env var (NTFY_SMTP_SENDER_VERIFY), server.yml docs, config generator toggle, and config reference table entry.

Tests: User manager tests for email CRUD + duplicate detection (SQLite + PostgreSQL), server tests covering verified address, bool value resolution, anonymous rejection, no-verified-emails, and backwards compatibility.