Redirect to client app after email verification

[alejandro-runner]

Summary

• Adds optional redirect_uri parameter to /api/auth/register so client apps can specify where users should return after email verification
• Stores redirect_uri in the users table and returns it as redirect_to in the verify-email response
• Frontend already handles redirect_to (OAuth redirect logic), so no frontend changes needed

Closes #12

Changes

File	What
database/migrations/20260412000000_add_user_redirect_uri.sql	Adds nullable redirect_uri column to users
core/src/repositories/user.rs	Stores/retrieves redirect_uri in registration and verification queries
api/src/api/http/auth.rs	Accepts redirect_uri on register, validates it (HTTPS or localhost), returns it after verification with ?verified=1

How it works

1. Client app sends POST /api/auth/register with redirect_uri: "https://account.staging.synvya.com"
2. Keycast stores it alongside the verification token
3. After email verification, backend returns redirect_to: "https://account.staging.synvya.com?verified=1"
4. Existing frontend redirect logic kicks in — user lands back on the client app

Client-side change required

The Synvya account app needs to include redirect_uri in its registration request body.

Test plan

• Register with redirect_uri set → verify email → confirm redirect to client app with ?verified=1
• Register without redirect_uri → verify email → confirm existing behavior (redirect to /)
• Register with invalid redirect_uri (e.g. ftp://...) → confirm it's silently ignored
• Re-verify already-verified email → confirm no redirect (existing behavior)

🤖 Generated with Claude Code