feat: implement secure email verification flow with token hashing and expiration logic

[Chongai-Cli]

The implementation is successful. Here's a summary of everything
implemented:

Schema (prisma/schema.prisma)

• Added verificationToken String? @unique, verificationExpiry
  DateTime?, failedVerifyAttempts Int @default(0) to User
• Added VerificationLog model with audit trail (userId,
  action, tokenHash, ipAddress, userAgent)

Token security (src/utils/crypto.ts)

• Added generateVerificationToken() —
  crypto.randomBytes(32).toString('base64url')
• Plaintext token sent in email, SHA-256 hash stored in DB
  (existing sha256() method used)

Email templates (src/templates/verify-email.{html,txt})

• Responsive HTML + plain-text fallback with {{firstName}},
  {{verificationLink}}, {{year}} placeholders

Auth service (src/services/auth.service.ts)

• register() — generates token/hash/expiry, sends email async
  (non-blocking), logs SENT, returns userId only (no
• verifyEmail(token) — hashes incoming token, checks expiry,
  handles lockout after 10 failed attempts, logs
  VERIFIED/EXPIRED/FAILED
• resendVerificationEmail(email) — Redis-backed per-email
  rate limit (3/hour), generates fresh token, logs RESENT,
  email-existence not revealed
• login() — blocks unverified users with 403 +
  EMAIL_NOT_VERIFIED code and resendUrl
• sanitizeUser() — strips passwordHash, verificationToken,
  verificationExpiry, failedVerifyAttempts from all responses

New endpoints (src/routes/auth.routes.ts)

• GET /api/v1/auth/verify-email?token= — no auth required
• POST /api/v1/auth/resend-verification — no auth required,
  IP-level rate limiter + per-email Redis limiter

requireVerified middleware (src/middleware/auth.ts)

• DB lookup on emailVerified; returns 403 with { code:
  'EMAIL_NOT_VERIFIED', resendUrl } if false
• Applied to: POST /donations, POST /distributions, POST
  /beneficiaries/:id/kyc

Tests

• 21 unit tests (src/services/auth.service.test.ts) — token
  format, hash storage, expiry, rate limits, lockout,
  sanitization
• 15 integration tests
  (tests/integration/email.verification.flow.test.ts) — full
  register→verify→login flow, expired tokens, resend rate
  limits, security properties, email delivery content

closes #68

[BarryArinze]

Resolve conflict

[GBOYEE]

I will take this issue. Strong full-stack background, clean PR coming shortly.

[GBOYEE]

I'd like to work on this issue. I have background in full-stack and will submit a PR ASAP.

[Chongai-Cli]

Conflicts have been resolved and the pr is ready for merging. Apologies about the delay