Gate password sign-in on email verification

Unverified password identities were able to open sessions after
signing out. Reject sign-in with EMAIL_NOT_VERIFIED and add a
resend-confirmation flow so users can complete verification.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/iam/errors.go

@@ -108,6 +108,16 @@ func (e ErrEmailAlreadyVerified) Error() string {
 	return e.message
 }
 
+type ErrEmailNotVerified struct{ message string }
+
+func NewEmailNotVerifiedError() error {
+	return &ErrEmailNotVerified{"email address not verified"}
+}
+
+func (e ErrEmailNotVerified) Error() string {
+	return e.message
+}
+
 type ErrIdentityNotFound struct{ IdentityID gid.GID }
 
 func NewIdentityNotFoundError(identityID gid.GID) error {