verify-email.ts and resend-verification.ts both import Zod schemas
and response-data types that did not exist in contracts/auth/schema.ts.
That left the two controllers uncompilable and blocked any attempt to
hit the REST verification endpoints (the OIDC flow renders
verify-pending.hbs via the controller, so the same schemas are part
of the contract for the email-verification flow from PROGRESS.md §13).

Adds:
- VerifyEmailQuerySchema — { token }
- VerifyEmailResponseDataSchema + VerifyEmailResponseData type
- VerifyEmailResponseSchema (envelope)
- ResendVerificationBodySchema — { email }
- ResendVerificationResponseDataSchema + ResendVerificationResponseData
  type — expires_at is nullable because the controller returns null
  when the user is unknown or already verified (PLANS.md §3 ADR — no
  email enumeration)
- ResendVerificationResponseSchema (envelope)

Each schema follows the conventions in the rest of schema.ts: z.iso
for datetimes, z.email() for email fields, .openapi(...) for Swagger
metadata, and the ApiResponseSchema envelope wrapper.
Co-authored-by: Cursor <cursoragent@cursor.com>