feat(identity): add email verification flow

Add native email verification to identity-service so we can stop relying
on Bouncer's deliverability check. New columns isEmailVerified,
emailVerificationToken (sha256-hashed), and emailVerificationTokenCreatedAt
are added to the Users table. Signup now sends a verification email with
a 24h-expiring token, exposes GET /email/verify and authed POST
/email/resend-verification, and rejects signups from disposable-email
domains (open-source blocklist embedded as a static file). Recovery and
welcome email suppression now honors isEmailVerified, falling back to
the legacy isEmailDeliverable flag so existing accounts keep working.
Bouncer code is intentionally left in place; removal will follow once
verification has rolled out.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dylanjeffers

packages/identity-service/sequelize/migrations/20260521000000-add-email-verification.js

@@ -0,0 +1,35 @@
+'use strict'
+
+module.exports = {
+  up: async (queryInterface, Sequelize) => {
+    await queryInterface.addColumn('Users', 'isEmailVerified', {
+      type: Sequelize.BOOLEAN,
+      allowNull: false,
+      defaultValue: false
+    })
+    await queryInterface.addColumn('Users', 'emailVerificationToken', {
+      type: Sequelize.STRING,
+      allowNull: true
+    })
+    await queryInterface.addColumn('Users', 'emailVerificationTokenCreatedAt', {
+      type: Sequelize.DATE,
+      allowNull: true
+    })
+    await queryInterface.addIndex('Users', ['emailVerificationToken'], {
+      name: 'users_email_verification_token_idx'
+    })
+  },
+
+  down: async (queryInterface) => {
+    await queryInterface.removeIndex(
+      'Users',
+      'users_email_verification_token_idx'
+    )
+    await queryInterface.removeColumn(
+      'Users',
+      'emailVerificationTokenCreatedAt'
+    )
+    await queryInterface.removeColumn('Users', 'emailVerificationToken')
+    await queryInterface.removeColumn('Users', 'isEmailVerified')
+  }
+}

packages/identity-service/src/config.js

@@ -773,6 +773,12 @@ const config = convict({
     env: 'websiteHost',
     default: 'https://audius.co'
   },
+  identityServiceHost: {
+    doc: 'Publicly reachable base URL of this identity service instance',
+    format: String,
+    env: 'identityServiceHost',
+    default: 'https://identityservice.audius.co'
+  },
   amplitudeAPIKey: {
     doc: 'Amplitude API key',
     format: String,