[Feat] Show email identity status in Linked Accounts

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Added an Email row to Personal Settings > Linked Accounts with a distinct Verified or Not verified status for the primary login address.
• Added a protected, rate-limited Resend action for the authenticated user's login email. It reuses Better Auth's verification token and session checks plus the configured AgentMail sender, while explicit resend delivery failures reach the client instead of displaying success.
• Listed addresses connected through the existing inbound email-link flow separately as Email sender entries with Linked status.
• Resolved the AgentMail inbox's live deliverable email for admin linking instructions, without falling back to its routing inbox_id.
• Added truthful guidance for enabled, unconfigured, member-only, and email-disabled deployment states without introducing another address-entry or linking flow.
• Updated the AgentMail documentation and focused server/client coverage.

Why this change was made

Email verification and AgentMail sender linking already existed, but neither status nor the existing linking journey was discoverable from Linked Accounts. This makes both identities visible while keeping login verification and sender authorization semantically and technically separate.

Impact

Users can now see whether their login email is verified, request another verification message only when AgentMail is configured, and identify addresses already authorized to start Roomote work by email. Admin linking instructions use only the live deliverable inbox address; members are directed to ask an admin, preserving the existing authorization boundary. Failed authenticated resends report an error, while signup and unauthenticated verification remain best effort so the public endpoint does not reveal whether an account exists. When email is disabled, the UI explains that verification delivery and sender linking are unavailable and offers no action.

[roomote-community]

No code issues found. See task

• Return the AgentMail inbox's deliverable address rather than its routing ID in the linking instructions.
• Do not show a successful resend verification action until AgentMail can actually deliver the message.
• Preserve unauthenticated verification resend's account-enumeration protection when delivery fails.

_{Reviewed 7528043}

[roomote-roomote]

Fixed the remaining account-enumeration finding in 75280439: the public verification callback remains best effort, while delivery-aware resend is now protected, session-bound, and rate-limited. See task.