web: PRO needs a proven address — email verification gates the studio

A signed-in account is served exactly like a guest until it opens the
verification link: watermarked 2048px export, no saving, no PRO frames,
GPS stamp or HDF. SMTP is declared in .env; with SMTP_HOST unset the link
goes to the container log. Allowlisted admins count as verified.

docker/docker-compose.yml

@@ -14,6 +14,15 @@ services:
       # Who may moderate the contributed strip: a comma-separated email
       # allowlist. Empty means nobody is an admin, which is the safe default.
       ADMIN_EMAILS: ${ADMIN_EMAILS:-}
+      # The relay that mails the "prove this address" link. Leave SMTP_HOST
+      # empty and the link is written to this container's log instead — a dev
+      # box needs no mail server, and the operator can read / copy it.
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-587}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASS: ${SMTP_PASS:-}
+      SMTP_FROM: ${SMTP_FROM:-}
+      SMTP_SECURE: ${SMTP_SECURE:-}
     volumes:
       # SQLite (WAL) lives on the host so a rebuild never loses accounts.
       - ./data:/data