Native uses the same verify API

iOS VerifyEmailFlow and Android splash verify call POST /api/v1/auth/verify and POST /api/v1/auth/verify/resend. They show the same generic resend copy. They do not mint a Keychain or EncryptedPrefs session from resend alone.

GET /api/v1/verify?q= lists these topics in-app. Impersonation stays web-only.