feat(auth): add email verification to registration flow

- Add email/email_verified/verification_token/verification_token_exp fields
  to app_users PocketBase schema (pb-init-v3.sh)
- Add SMTP env vars to UI service in docker-compose.yml
- New email.ts: raw TLS SMTP mailer via Node tls module, sendVerificationEmail()
- createUser() now takes email param, stores verification token (24h TTL)
- loginUser() throws 'Email not verified' when email_verified is false
- New /verify-email route: validates token, verifies user, auto-logs in
- Login page: email field in register form, check-inbox state after register
- /api/auth/register (iOS): returns { pending_verification, email } instead of token
- Add pb.libnovel.cc and storage.libnovel.cc Caddy virtual hosts for homelab runner
- Add homelab runner docker-compose and libnovel.sh helper script

Caddyfile

@@ -43,8 +43,8 @@
 	# Email for Let's Encrypt ACME account registration.
 	# When CADDY_ACME_EMAIL is set this expands to e.g. "email you@example.com".
 	# When unset the variable expands to an empty string and Caddy ignores it.
-	{$CADDY_ACME_EMAIL:}
-
+	email {$CADDY_ACME_EMAIL:}
+
 	# CrowdSec bouncer — streams decisions from the CrowdSec LAPI every 15s.
 	# CROWDSEC_API_KEY is injected at runtime via crowdsec/.crowdsec.env.
 	# The default "disabled" placeholder makes the bouncer fail-open (warn,
@@ -238,3 +238,19 @@ push.libnovel.cc {
 	reverse_proxy gotify:80
 }
 
+# ── PocketBase: exposed for homelab runner task polling ───────────────────────
+# Allows the homelab runner to claim tasks and write results via the PB API.
+# Admin UI is also accessible here for convenience.
+pb.libnovel.cc {
+	import security_headers
+	reverse_proxy pocketbase:8090
+}
+
+# ── MinIO S3 API: exposed for homelab runner object writes ────────────────────
+# The homelab runner connects here as MINIO_ENDPOINT to PutObject audio/chapters.
+# Also used as MINIO_PUBLIC_ENDPOINT for presigned URL generation.
+storage.libnovel.cc {
+	import security_headers
+	reverse_proxy minio:9000
+}
+}