Gate password sign-in on email verification

Unverified password identities were able to open sessions after
signing out. Reject sign-in with EMAIL_NOT_VERIFIED and add a
resend-confirmation flow so users can complete verification.

Signed-off-by: Émile Ré <emile@probo.com>

contrib/helm/charts/probo/templates/deployment.yaml

@@ -122,6 +122,8 @@ spec:
               value: {{ .Values.probo.auth.disableSignup | quote }}
             - name: PROBOD_AUTH_INVITATION_TOKEN_VALIDITY
               value: {{ .Values.probo.auth.invitationTokenValidity | quote }}
+            - name: PROBOD_AUTH_EMAIL_CONFIRMATION_TOKEN_VALIDITY
+              value: {{ .Values.probo.auth.emailConfirmationTokenValidity | quote }}
             - name: PROBOD_AUTH_COOKIE_NAME
               value: {{ .Values.probo.auth.cookieName | quote }}
             - name: PROBOD_AUTH_COOKIE_DOMAIN

contrib/helm/charts/probo/values.yaml

@@ -225,6 +225,8 @@ probo:
   auth:
     disableSignup: false
     invitationTokenValidity: 3600
+    # Email confirmation token validity in seconds (default: 3600 = 1 hour)
+    emailConfirmationTokenValidity: 3600
     cookieName: "SSID"
     cookieDomain: "probo.example.com"
     # REQUIRED: Generate with openssl rand -base64 32