Signup lands on verify email

After create, web signs in and routes to /verify. Native waits for the verification deep link.

A valid create signs in with the new password and opens /verify (or redirect_to after verify). It does not skip email confirmation.

Forgot password is /forgot. It does not mint a display name.