Fix: Use strong key for sign-in email link

[mattwoberts]

Fixes #1458

Summary

• The sign-in email link previously used the same 6-digit numeric code as the manual entry flow, making it brute-forceable (only 1,000,000 possible values, no email required for the link flow)
• Now generates a separate 64-char cryptographic link_key for the email URL, while keeping the 6-digit code for manual entry (which requires the email address, limiting the attack surface)
• Makes the 6-digit code single-use — reuse now returns a 400 error instead of allowing re-authentication

Test plan

• make lint passes
• All existing tests updated and passing
• New test added: TestVerifySignInCodeHandler_AlreadyVerifiedCode_ShouldReject
• Run make migrate to apply the new code column migration
• Manual: trigger sign-in, verify email link uses a long key, verify 6-digit code works for manual entry
• Manual: verify that reusing a 6-digit code after successful sign-in is rejected

🤖 Generated with Claude Code