Verify emailAccount
Link lasts 48 hours
The emailed link expires after two days. Ask again if it timed out.
VERIFY_TTL_MS is 48 hours. After that, this page rejects the code and the buyer requests a new link.
The server stores a sha256 digest. Plaintext never stays in the database.