feat: per-account SMTP email settings and admin account approval

[scracha]

Summary

Adds multi-tenancy support for email configuration and a registration approval gate.

Per-Account SMTP Email Settings

• Each account (tenant) can configure their own SMTP server via Account Settings > Email tab
• Falls back to server-level .env SMTP when not configured or disabled
• SMTP password encrypted at rest (Laravel encrypted cast)
• SSRF protection on SMTP host field (blocks private/internal IPs and cloud metadata endpoints)
• Password never returned to frontend (only smtp_password_set boolean)
• Admin-only access enforced on both GET and POST endpoints

Admin Account Approval

• New env vars: APP_REQUIRE_ACCOUNT_APPROVAL and APP_ADMIN_EMAIL
• When enabled, new registrations require admin approval before login is permitted
• Admin receives an email with a signed magic link (30-day expiry, AES-256 encrypted token)
• Login page shows clear pending approval message with a Resend Approval Request button
• Resend endpoint is rate-limited (3 per 10 minutes) to prevent admin inbox spam
• Existing accounts are backfilled as approved during migration

New API Endpoints

• GET /accounts/{id}/email-settings (auth + admin)
• POST /accounts/{id}/email-settings (auth + admin)
• GET /accounts/approve?token=... (public, magic link)
• POST /accounts/resend-approval (public, rate-limited)

Database Migrations

• create_account_email_settings table
• add approved_at to accounts (backfills existing as approved)

Frontend

• Email Settings tab in Account Settings (admin-only)
• Pending Approval page after registration
• Admin Approve Account page (standalone, no auth needed)
• Login error now shows actual API message instead of generic text

.env.example updated

• APP_REQUIRE_ACCOUNT_APPROVAL=false
• APP_ADMIN_EMAIL=