Add authentication or rate limiting to check-verified endpoint

Issue

The /api/auth/check-verified?email=... endpoint is unauthenticated and has no rate limiting. Anyone can query it to determine whether a verified account exists for a given email address.

• { verified: true } — email is registered and verified
• { verified: false } — email is either unregistered or unverified (indistinguishable)

This enables automated email enumeration against known email lists.

Impact

Low severity. The endpoint is read-only and cannot modify any state. A true response confirms account existence, but false does not distinguish between non-existent and unverified accounts.

Options

1. Require authentication — check ctx.state.user and only allow users to query their own email
2. Rate limit — throttle requests per IP (e.g., 5 per minute) at the nginx or app layer
3. Remove the endpoint — have the client poll /api/auth/session instead (requires authentication by design), though this only works when a session exists