fix: restore verifyEmail error logging

[leno23]

Summary

• restore the verifyEmail catch-block error log before forwarding to Express error handling
• add a regression test that asserts the underlying error is logged and passed to next(error)

Closes #2295

Tests

• src/controllers/UsersControllers.ts and src/controllers/UsersControllers.test.ts parse successfully with the TypeScript parser
• source-level proof confirmed the controller contains console.error('Email verification failed:', error) and the regression test asserts that log + next(error) path

Not run: pnpm test src/controllers/UsersControllers.test.ts because both git clone and GitHub archive download for a full checkout were denied in this environment. The patch is intentionally small and includes the focused Jest regression test for project CI to run.

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[aalemayhu]

Welcome, and thanks for the focused fix — small PR, clear repro test, matches the parallel 'Magic link verification failed:' pattern at line 761. Nothing here blocks merge.

Verdict: approve (comment-only since I can't self-approve via tooling)

A missing log was making #2295 harder to debug; restoring it is a direct simplicity win.

Blocking

• None.

Nits (optional, not asks)

• src/controllers/UsersControllers.test.ts — the test asserts both calls happened but not the order. Since the regression is "log before forward", you can lock it in with expect(consoleError.mock.invocationCallOrder[0]).toBeLessThan(next.mock.invocationCallOrder[0]). The source has them on consecutive lines so it's implicit today, but the assertion would catch a future reorder.
• src/controllers/UsersControllers.test.ts — the try/finally + mockRestore is correct but slightly heavier than needed; verifyEmail catches its own errors, so a trailing consoleError.mockRestore() would do. Matter of taste.

When you're ready, flip from draft with gh pr ready 2340 and I'll merge.