Resend uses the same unknown-email copy

Unknown addresses get the same generic copy. Kumir does not 404.

POST /api/auth/verify/resend and POST /api/v1/auth/verify/resend always return the same generic message. Unknown emails do not 404.

VERIFY_MAX_PER_HOUR is 5. Extra resends still return the generic copy. Rate limit on auth-verify-resend is 8 per 15 minutes.