feat(site): allow disabling email verification

[AsyncAssassin]

Fixes #1517

Proposed Changes

• Add a require_email_verification login setting that defaults to true to preserve the current behavior.
• Expose the setting through the admin login settings API and UI.
• Allow newly registered email users to become active immediately when email verification is disabled.
• Keep existing unverified users unchanged.
• Add migration and regression tests for legacy login settings and registration behavior.

Testing

• go test ./internal/migrations -run 'TestBackfillRequireEmailVerification|TestAddRequireEmailVerification|TestSplitLegalMenuKeepsRequireEmailVerificationDefaultTrue' -count=1 -v
• go test ./...
• make lint
• make ui
• make build