web: PRO needs a proven address — email verification gates the studio

A signed-in account is served exactly like a guest until it opens the
verification link: watermarked 2048px export, no saving, no PRO frames,
GPS stamp or HDF. SMTP is declared in .env; with SMTP_HOST unset the link
goes to the container log. Allowlisted admins count as verified.

docker/backend/package.json

@@ -12,11 +12,13 @@
   },
   "dependencies": {
     "better-sqlite3": "^12.11.1",
-    "fastify": "^5.12.5"
+    "fastify": "^5.12.5",
+    "nodemailer": "^7.0.13"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^22.20.3",
+    "@types/nodemailer": "^8.0.2",
     "tsx": "^4.23.13",
     "typescript": "^5.9.3"
   }