feat: email verification for free tier signup

- Signup now requires email verification before API key is revealed
- Verification token sent via email (Resend) with console fallback
- GET /verify?token=xxx shows API key in styled HTML page
- Handles expired (24h), invalid, and already-verified tokens
- Frontend modal shows 'check your email' instead of key
- Keeps existing rate limiting

public/index.html

@@ -357,14 +357,11 @@ html, body {
     </div>
 
     <div id="signupResult">
-      <h2>🚀 You're in!</h2>
+      <h2>📧 Check your email!</h2>
+      <p style="color:var(--fg);line-height:1.7;">We've sent a verification link to your email address. Click the link to get your API key.</p>
       <div class="warning-box">
-        <span class="icon">⚠️</span>
-        <span>Save your API key now — we can't recover it later.</span>
-      </div>
-      <div class="key-box" id="apiKeyDisplay">
-        <span class="key-text" id="apiKeyText"></span>
-        <button class="copy-btn" id="copyBtn">Copy</button>
+        <span class="icon">💡</span>
+        <span>The link expires in 24 hours. Check your spam folder if you don't see it.</span>
       </div>
       <p style="margin-top:20px;color:var(--muted);font-size:0.9rem;">100 free PDFs/month • <a href="/docs">Read the docs →</a></p>
     </div>