feat(email): require verified approval email

Backfill approved legacy users with verified emails and replace the old unverified-email warning setting with a single approval email policy.

apps/backend/migration_steps/legacy_user_email_verification.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from sqlalchemy import text
+from sqlalchemy.engine import Connection
+
+
+def apply(conn: Connection) -> None:
+    verified_at = datetime.now(timezone.utc).isoformat()
+    conn.execute(
+        text(
+            """
+            UPDATE users
+            SET email_verified_at = :verified_at
+            WHERE email_verified_at IS NULL
+              AND email IS NOT NULL
+              AND email != ''
+              AND is_approved = 1
+            """
+        ),
+        {"verified_at": verified_at},
+    )
+    conn.commit()