Add post-signup email verification without changing manual activation

[Copilot]

This introduces a separate email-verification step after signup while preserving the existing manual admin activation flow. New users can now confirm ownership of their email address, but verification alone does not activate the account.

• Verification state

  • Add Profile.email_verified to persist whether a signup email has been confirmed.

• Signup email flow

  • Generate a signed verification token from the user id + email.
  • Add an absolute /validate-email/ link to the signup emails for basic, educational, and researcher plans.
  • Keep staff notification and manual activation behavior unchanged.

• Verification endpoint

  • Add a public validate-email view and route.
  • Verify the signed token, mark the profile as verified, and return a simple confirmation page.
  • Do not flip User.is_active; admin activation remains the only activation path.

• Token handling

  • Scope tokens with a dedicated signing salt.
  • Enforce expiry via ACCOUNT_ACTIVATION_DAYS.
  • Compare email values case-insensitively before marking the profile as verified.

• Focused coverage

  • Add tests for:
    • verification link generation
    • signup email content including the verification link
    • successful verification updating Profile.email_verified
    • invalid token rejection

Example of the new link construction:

def build_email_validation_link(user: User) -> str:
    token = signing.dumps(
        {"user_id": user.pk, "email": user.email},
        salt=EMAIL_VALIDATION_SALT,
    )
    return (
        f"{settings.IMPRESSO_BASE_URL}{reverse('validate-email')}?"
        f"{urlencode({'token': token})}"
    )

• Fixes add email validation after users sign up #153