Auth: require email-verified by default for all app-data routes

Previously only 2 share-code routes required a verified email; every other
authenticated route (residences, tasks, contractors, documents, notifications,
subscription, users, uploads, media — ~70 routes) accepted an authenticated but
UNVERIFIED user. This inverts the default to verified-by-default.

- router.go: add a `verified` sub-group that applies RequireVerified() ONCE at
  the group level, and move all app-data route setups under it. Verification is
  now the default; new routes are gated automatically. The authenticated-only
  allow-list is just the sign-up surface (/auth/me, /auth/profile, /auth/account).
  Public stays: register, health, webhooks, lookups.
- kratos_auth.go: fix a latent bug the gating exposed — the Redis session cache
  stored the verified flag for 24h, so a user who verified their email mid-session
  was still seen as unverified until the TTL expired (sign up -> verify -> create
  residence would 403). Now only a cached verified=true is trusted (verification
  is sticky); a cached verified=false re-resolves the live status from Kratos.
- auth_safety_test.go: add RequireVerified unit tests (verified passes,
  unverified -> 403, no-user -> 401).

Validated: API gating test (unverified->403, verified->200) + full iOS XCUITest
suite green (211 passed) including the onboarding verify->use-immediately flow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/middleware/kratos_auth.go

@@ -131,14 +131,20 @@ func (m *KratosAuth) resolve(c echo.Context) (*models.User, bool, string, error)
 	cacheKey := kratosSessionPrefix + hashCredential(cred)
 	if m.cache != nil {
 		if v, err := m.cache.GetString(ctx, cacheKey); err == nil && v != "" {
-			if user, verified, ok := m.userFromCacheValue(ctx, v); ok {
-				// Sliding-window refresh: extend the TTL on every successful
-				// hit so active users don't get bounced when their original
-				// cache entry would have otherwise expired. Best-effort —
-				// failure to refresh just means the entry expires on the
-				// original schedule.
+			// Only a cached `verified=true` is authoritative — email verification
+			// is sticky (it never reverts), so we can safely short-circuit.
+			// A cached `verified=false` is deliberately NOT trusted: the user may
+			// have verified their email since this entry was written, and a stale
+			// false would lock a just-verified user out of every verified-gated
+			// route until the 24h TTL expired (e.g. sign up -> verify -> create a
+			// residence immediately). On a cached false we fall through and
+			// re-resolve the live status from Kratos /whoami below.
+			if user, verified, ok := m.userFromCacheValue(ctx, v); ok && verified {
+				// Sliding-window refresh: extend the TTL on every successful hit
+				// so active (verified) users aren't bounced when their entry
+				// would otherwise expire. Best-effort.
 				_ = m.cache.SetString(ctx, cacheKey, v, kratosSessionCacheTTL)
-				return user, verified, cred, nil
+				return user, true, cred, nil
 			}
 		}
 	}