fix(auth): don't require email verification to sign in

Transactional email only sends when RESEND_API_KEY is set; without it
sendEmail() silently no-ops. Combined with requireEmailVerification: true,
that meant every newly registered account was permanently locked out — the
verification link was never delivered and unverified users could not log in.

Verification mail is still sent on signup when email is configured; it is no
longer a barrier to signing in. Re-enable once transactional email is live.

Note: password reset still depends on email delivery, so users who forget a
password remain stuck until RESEND_API_KEY is configured.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/auth/auth.ts

@@ -131,10 +131,13 @@ export const auth = betterAuth({
 
   emailAndPassword: {
     enabled: true,
-    // SECURITY GATE: unverified emails CANNOT sign in. Verification emails are sent
-    // on signup (see emailVerification.sendOnSignUp below), so users can verify before
-    // their first login.
-    requireEmailVerification: true,
+    // Sign-in does NOT require a verified email. This is deliberate: verification
+    // mail only sends when RESEND_API_KEY is configured, and without it sendEmail()
+    // silently no-ops — gating sign-in on verification would lock out every new
+    // account. Verification mail is still sent when email is configured (see
+    // emailVerification.sendOnSignUp below); it just isn't a barrier to logging in.
+    // Turn this back on once transactional email is live and proven.
+    requireEmailVerification: false,
     minPasswordLength: 8,
     async sendResetPassword({ user, url }) {
       await sendEmail({