Add email verification requirement on signup

[PeaStew]

Summary

The auth service allows signup with any email address and no verification. Accounts are immediately active. This makes mass account creation trivial for bots — generate random emails, register, get tokens, abuse.

Impact

• Sybil attacks: create thousands of accounts for point farming
• No accountability — throwaway emails with no verification
• Database pollution with fake accounts

Recommendation

better-auth (already in use) supports email verification natively:

emailAndPassword: {
  enabled: true,
  requireEmailVerification: true,
  sendVerificationEmail: async ({ user, url }) => {
    await sendEmail({
      to: user.email,
      subject: "Verify your email",
      body: `Click here to verify: ${url}`
    });
  }
}

Additional measures

• Add email domain blocklist (disposable email providers: mailinator, tempmail, guerrillamail, etc.)
• Consider requiring a verified email before any point-earning actions
• Rate limit verification email sends (max 3 per email per hour)

References

• better-auth docs: email verification plugin
• Disposable email blocklist: github.com/disposable-email-domains/disposable-email-domains