security(verify-email): one decision core, reject empty-subject token

[lakhansamani]

Re-targets #752 onto main. That PR is merged — which is why it does not show up in the open list — but it merged into security/2.4.0-audit-part-2 four minutes after that branch had already merged to main, so it landed in a dead end.

Re-verified against current main (3f17f68a) before opening this:

$ git merge-base --is-ancestor 01e0f76b origin/main   →  NO, not in main
$ git ls-tree origin/main internal/service/           →  no verify_email_core.go
$ git grep "verification token has no subject" main   →  ABSENT

None of it shipped, including in 2.4.0-rc.16.

What it does

One decision core. The GraphQL and REST verify-email paths had drifted apart twice, each time because the same decision was written in two places — the second drift is the bug users hit, where a verification click that landed on the MFA gate never wrote email_verified_at.

Both paths now call ConsumeEmailVerificationToken, which owns token lookup, JWT validation, purpose binding, subject handling, user lookup, the revoked check, and the verified write. The write happens before any caller gate — that ordering is precisely what the earlier bug got wrong.

Empty-subject tokens are refused. ValidateJWTClaims passes on an empty sub, because User.ID is "" at that call site — so a token with no subject validated and resolved to no principal instead of failing.

The one conflict, and why both sides are kept

signup_verification_matrix_test.go. Main gained TestTOTPEnrollmentWorksForPhoneOnlyAccounts from #753 while this branch added the expired-link and empty-subject tests.

Worth noting how this failed loudly rather than silently: my first resolution stripped the conflict markers mechanically, which spliced two functions together because HEAD's closing brace sat after the >>>>>>> marker as shared context. gofmt/go vet caught it immediately. All three tests are present and the file parses.

Verified

• go build ./... — 0
• go vet ./... — 0
• All 10 tests in the verification matrix pass, including the two this PR adds
• make test — 42 packages, 0 failures
• make lint — clean

Once merged this should go into an rc — rc.16 went out without it.