web: PRO needs a proven address — email verification gates the studio

A signed-in account is served exactly like a guest until it opens the
verification link: watermarked 2048px export, no saving, no PRO frames,
GPS stamp or HDF. SMTP is declared in .env; with SMTP_HOST unset the link
goes to the container log. Allowlisted admins count as verified.

docker/.env.example

@@ -5,3 +5,19 @@ WEB_PORT=8090
 # Comma-separated emails allowed to moderate the landing strip (/admin).
 # Leave empty to make nobody an admin.
 ADMIN_EMAILS=
+
+# The mail relay that sends the address-verification link. A new account is a
+# guest until it follows that link, so a deployment without a relay can only
+# ever hand out guest access.
+#
+# Leave SMTP_HOST empty and the link is written to the api container's log
+# instead (`docker compose logs api`), which is enough for local work.
+SMTP_HOST=
+# 587 upgrades to TLS (STARTTLS); 465 is TLS from the first byte. Set
+# SMTP_SECURE=true to force the latter on an unusual port.
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+# What the mail says it is from. Defaults to SMTP_USER, then a noreply address.
+SMTP_FROM=
+SMTP_SECURE=