- Add POST /auth/verification-code endpoint to email a code - Store codes in Redis and verify them during registration - Send verification emails asynchronously via Thymeleaf - Replace email_verified column with code-based verification - Group dependencies into version catalogue bundles