/verify/email — the verify-link landing state machine (GET token → POST /verify/email/confirm)
One route, three outcomes
Verifying your email…
One moment while we confirm your link.
Email verified
Your account is fully active. You're all set.
This link has expired
Verification links are good for 30 minutes. Request a fresh one and we'll send it right over.
The API returns 200 VerificationStatus on success and an EXPIRED / INVALID_CODE
error code otherwise — the landing decides which of these three it shows from that single response.
An already-verified token also lands on verified (idempotent), never an error.