feat(registration): add email confirmation UI

New ConfirmEmailPage for users to verify their email and set password.
Resend form on registration and error pages. Registration form no
longer asks for a password. Confirmation requires a button click. The
admin list marks unconfirmed requests and offers only delete for them.

README.md

@@ -92,8 +92,12 @@ To Be Played is split into three repositories:
 - **Language**: kept in the browser and saved in Auth; after the login Auth's language wins when one is saved. Dark
   mode stays per device. The registration sends the browser language (`de` for a German browser, else `en`): Auth
   writes its mails in it and saves it as the user's language.
-- **Registration** (`/register`): no invite code; the page says that an admin checks each new account and stays on
-  "registration sent" after the send. Auth answers `409 PENDING_LIMIT_REACHED` while 20 wait.
+- **Registration** (`/register`): no invite code; the form asks for email and display name only (no password); the page says that the user gets a mail with a link, then an admin
+  checks the request, and stays on "registration sent" after the send. Auth answers `409 PENDING_LIMIT_REACHED` while
+  20 wait. The mail link opens `/confirm-email#<token>` (the token stays in the fragment and goes to Auth in a POST
+  body); the page asks for the password (and its repeat) and confirms on a button click, not on load, so mail scanners do not burn the link. An expired or used
+  link and the page after the send offer "send the link
+  again" (same answer for any address).
 - **Broken pictures**: a Steam cover or achievement icon that does not load shows a placeholder and is reported
   to Core once per page load (`POST /api/library/broken-images`, only with a session). Core repairs it at night;
   a repaired cover comes back as `imageUrl`.
@@ -102,7 +106,7 @@ To Be Played is split into three repositories:
   typed to confirm a delete). "View as" in the menu switches the own session to User or Auditor and back; a badge
   shows the lower role. Auth checks every right on the server. Registrations that wait show "Waits" with Accept
   and Deny (a "Waiting only" filter lists just them); the menu shows how many wait, loaded again on every page change
-  and menu opening. The login tells a waiting user that the admin has not decided yet.
+  and menu opening. A request whose address is not confirmed shows "Not confirmed" and only a Delete button. The login tells a waiting user that the admin has not decided yet.
 - **Dashboard hints**: news from the admin at the bottom of the dashboard, one at a time. A "Dismiss" hint closes
   after 30 s or with X and comes back in the next browser session unless "Do not show again" is ticked; an
   "Accept" hint stays until "OK". Admins write, preview and end hints on `/admin/hints` (Auth stores them).