security: backup email verification tokens have no server-side expiry

[aspiers]

Problem

The backup email verification flow claims tokens expire in 24 hours (email template in packages/auth-service/src/email/sender.ts:380,384), but the server enforces no expiry.

The backup_email table (packages/shared/src/db.ts:92-100) has no expires_at column, and verifyBackupEmail() (packages/auth-service/src/routes/account-settings.ts:179-180) checks only the SHA-256 hash match — not any timestamp.

A verification link works indefinitely until used.

Proposed Fix

1. Add a created_at column (or expires_at) to the backup_email table via a new migration.
2. Check the timestamp in verifyBackupEmail() and reject tokens older than 24 hours.
3. Add periodic cleanup of unverified backup emails older than 24 hours.

Severity

Moderate — an old, intercepted verification link could be used long after the user expects it to have expired.