feat: email verification for free tier signup

- Signup now requires email verification before API key is revealed
- Verification token sent via email (Resend) with console fallback
- GET /verify?token=xxx shows API key in styled HTML page
- Handles expired (24h), invalid, and already-verified tokens
- Frontend modal shows 'check your email' instead of key
- Keeps existing rate limiting

docker-compose.yml

@@ -13,6 +13,7 @@ services:
       - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
       - BASE_URL=${BASE_URL:-https://docfast.dev}
       - PRO_KEYS=${PRO_KEYS}
+      - RESEND_API_KEY=${RESEND_API_KEY:-FILL_IN}
     volumes:
       - docfast-data:/app/data
     mem_limit: 512m