Email integration tests

[hateofhades]

What

Integration tests for all email milestone features. Tests run with APP_ENV=development so no real SMTP is needed — emails are logged to console and tokens are returned or queryable from DB.

Acceptance Criteria

Forgot-password

• Known email → 200 (same response shape)
• Unknown email → 200 (identical response — no enumeration)
• Token stored in DB with correct expiry
• Reset token is hashed in DB (raw token not stored)

Reset-password

• Valid token + new password → 200 + new tokens
• Used token (second use) → 400 INVALID_TOKEN
• Expired token → 400 INVALID_TOKEN
• All refresh tokens deleted after password reset

Email verification

• Unverified user: POST /register → verification email logged to console
• Valid verification token → user.email_verified_at set
• Already-verified user using old token → still 200 (idempotent)
• Unverified user attempts M5 feature → 403 EMAIL_NOT_VERIFIED
• Resend verification: invalidates old token, creates new one