Gate password sign-in on email verification

Unverified password identities were able to open sessions after
signing out. Reject sign-in with EMAIL_NOT_VERIFIED and add a
resend-confirmation flow so users can complete verification.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/connect/v1/graphql/session.graphql

@@ -17,6 +17,9 @@ extend type Mutation {
     @authentication(required: NONE)
   verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
     @authentication(required: OPTIONAL)
+  resendVerificationEmail(
+    input: ResendVerificationEmailInput!
+  ): ResendVerificationEmailPayload @authentication(required: NONE)
   changePassword(input: ChangePasswordInput!): ChangePasswordPayload
     @authentication(required: PRESENT) @sessionOnly
   changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
@@ -102,6 +105,10 @@ input VerifyEmailInput {
   token: String!
 }
 
+input ResendVerificationEmailInput {
+  email: EmailAddr!
+}
+
 input ChangePasswordInput {
   currentPassword: String!
   newPassword: String!
@@ -152,6 +159,10 @@ type VerifyEmailPayload {
   success: Boolean!
 }
 
+type ResendVerificationEmailPayload {
+  success: Boolean!
+}
+
 type ChangePasswordPayload {
   success: Boolean!
 }