Don't enforce email verification at sign-in (yet); add CLAUDE.md

- emailAndPassword.requireEmailVerification = false so users can sign in
  immediately; verification emails are still sent and /verify-email still
  works. Flip back to true to make it mandatory later (TODO noted in code).
- Add backend/CLAUDE.md documenting stack, commands, the auth/schema
  generation workflow, and runtime gotchas.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth.ts

@@ -24,7 +24,11 @@ export const auth = betterAuth({
 
   emailAndPassword: {
     enabled: true,
-    requireEmailVerification: true,
+    // TODO(verification): Email verification is intentionally NOT enforced for
+    // now so users can sign in immediately. Verification emails are still sent
+    // (sendOnSignUp below) and the /verify-email flow still works — flip this
+    // back to `true` to make verification mandatory before sign-in.
+    requireEmailVerification: false,
     minPasswordLength: 12,
     maxPasswordLength: 256,
     revokeSessionsOnPasswordReset: true,