Add email verification for user registration

.github/workflows/e2e.yaml

@@ -30,6 +30,13 @@ jobs:
         ports:
           - 5433:5432
 
+      # MailHog - Mock SMTP server for email verification tests
+      mailhog:
+        image: mailhog/mailhog:v1.0.1
+        ports:
+          - 1025:1025   # SMTP
+          - 8025:8025   # Web UI / API
+
     steps:
       - uses: actions/checkout@v4
 
@@ -66,3 +73,7 @@ jobs:
           cargo test --package e2e-tests --locked
         env:
           DATABASE_URL: postgres://postgres:postgres@localhost:5433/postgres
+          # MailHog configuration for email verification tests
+          MAILHOG_HOST: 127.0.0.1
+          MAILHOG_SMTP_PORT: 1025
+          MAILHOG_API_PORT: 8025

.github/workflows/web-e2e.yaml

@@ -58,6 +58,24 @@ jobs:
           cd apps/zopp-web
           npx playwright install chromium --with-deps
 
+      - name: Start MailHog
+        run: |
+          docker run -d \
+            --name mailhog \
+            --network host \
+            mailhog/mailhog:v1.0.1
+          # Wait for MailHog to be ready
+          for i in {1..30}; do
+            if curl -sf http://localhost:8025/api/v2/messages > /dev/null 2>&1; then
+              echo "MailHog is ready"
+              exit 0
+            fi
+            echo "Waiting for MailHog... ($i/30)"
+            sleep 1
+          done
+          echo "ERROR: MailHog failed to become ready"
+          exit 1
+
       - name: Start zopp-server
         run: |
           ./target/debug/zopp-server serve --health-addr 0.0.0.0:8081 &
@@ -70,6 +88,14 @@ jobs:
             echo "Waiting for server... ($i/30)"
             sleep 1
           done
+        env:
+          # Email verification settings for MailHog
+          ZOPP_EMAIL_VERIFICATION_REQUIRED: "true"
+          ZOPP_EMAIL_PROVIDER: smtp
+          SMTP_HOST: 127.0.0.1
+          SMTP_PORT: "1025"
+          SMTP_USE_TLS: "false"
+          ZOPP_EMAIL_FROM: test@zopp.local
 
       - name: Create Envoy config for CI
         run: |
@@ -99,6 +125,10 @@ jobs:
           npx playwright test --reporter=list
         env:
           CI: true
+          # MailHog API for verification code retrieval
+          MAILHOG_API_URL: http://localhost:8025/api/v2
+          # Database URL for creating test invites
+          DATABASE_URL: sqlite://${{ github.workspace }}/zopp.db
 
       - name: Upload test results
         uses: actions/upload-artifact@v4
@@ -112,4 +142,5 @@ jobs:
         if: always()
         run: |
           docker stop envoy || true
+          docker stop mailhog || true
           pkill -f zopp-server || true

.gitignore

@@ -18,6 +18,8 @@ apps/zopp-web/test-results/
 *.db-*
 
 # .sqlx/ directories are committed per-backend for offline compile checks
+# Ignore root-level .sqlx (created by workspace-wide sqlx prepare, should not be committed)
+/.sqlx
 
 # Documentation build output
 docs/build/

CLAUDE.md

@@ -287,12 +287,32 @@ When creating PRs and working through CI:
 1. **Create the PR**: Use `gh pr create` with a clear title and description
 2. **Monitor CI**: Watch for CI check results
    - **Ignore docker builds** - they are slow and not required for most PRs
-   - Focus on: clippy, tests, fmt checks
-3. **Wait for Cubic review**: Cubic is an AI code reviewer that runs automatically
-   - Address any comments Cubic makes
-   - Iterate until Cubic has no further comments
-   - Re-run CI after making changes
-4. **Repeat until green**: Keep iterating until CI passes and Cubic is satisfied
+   - Focus on: clippy, tests, fmt checks, E2E tests, web-e2e tests
+3. **Work with Cubic reviews**: Cubic is an AI code reviewer that does two types of reviews:
+   - **Incremental reviews**: Automatically triggered on each push, reviews only changed files
+   - **Full reviews**: Triggered by tagging `@cubic-dev-ai` in a PR comment
+
+### Cubic Review Workflow
+
+1. **Initial full review**: When PR is created, Cubic does a full review of all changes
+2. **Address issues**: Fix any issues Cubic identifies, commit and push
+3. **Incremental review**: Cubic automatically reviews only the new changes (not the whole PR)
+   - Check the CI check output: "AI review completed with X review. Y issues found across Z files (changes from recent commits)"
+   - If issues found in the incremental review, fix them and push again
+   - If 0 issues found, your fixes are good - but this only covers the recent changes
+4. **Request full re-review**: Once incremental reviews pass, comment `@cubic-dev-ai Please do a full re-review of the PR.`
+5. **Wait for full review**: The full re-review examines the entire PR again and may find new issues
+6. **Iterate**: Repeat steps 2-5 until full review passes with 0 issues or only acceptable minor issues
+7. **Merge**: Only merge after the full re-review completes successfully - never merge while it's pending
+
+### Reading Cubic Results
+
+- **CI Check**: Look at the "cubic-dev-ai / cubic · AI code reviewer" check for quick status
+- **Review comments**: Cubic posts detailed issues as PR review comments
+- **Addressed marker**: When you fix an issue, Cubic edits its comment to show "✅ Addressed in <commit>" - check if comments are marked as addressed rather than waiting for a new review
+- **Outdated comments**: GitHub may mark comments as "outdated" if the code changed - these can often be ignored
+- **Confidence score**: Higher is better (5/5 means high confidence the code is good)
+- **Priority levels**: P1 (critical), P2 (important), P3 (minor) - always fix P1/P2
 
 Example workflow:
 ```bash
@@ -308,8 +328,12 @@ gh pr create --title "Add my feature" --body "Description..."
 # Monitor CI (ignore docker builds)
 gh pr checks
 
-# If Cubic comments, address them and push again
-# Repeat until all checks pass
+# Check Cubic's initial review, fix issues, push
+# Cubic does incremental review automatically
+# When incremental shows 0 issues, request full re-review:
+gh pr comment --body "@cubic-dev-ai Please do a full re-review of the PR."
+
+# Repeat until all checks pass and Cubic is satisfied
 ```
 
 ## Important Notes