feat: let a customer resend their own verification email (#110)

A verification email was sent once, at registration. If it was lost, filtered, or arrived after the 24-hour token had expired, the customer had no route back except registering again with a different address.

POST /api/customers/resend-verification mints a fresh token and sends the mail, and the account page grows a "Send it again" button beside the warning that was already there. The button only exists while the address is unverified: on a verified account it would be a control whose only outcome is a refusal, and the endpoint refuses that case rather than sending a pointless email.

The mint-token-and-send sequence now lives in one place. Registration and the email change already did the same three steps - supersede any outstanding token, mint a new one, send it - and this would have been a third copy. The step most likely to be dropped in a copy is the supersede, and it is the one that matters: without it an older message still sitting in the inbox goes on verifying.

Anything that makes the server send mail on request is an abuse vector, so this is rate limited to three an hour, keyed on the customer id. That is tighter than either existing limiter and sidesteps #84's IPv6 problem entirely, since a signed-in caller has an identity better than an address to count against and cannot escape the bucket by moving within a delegated prefix. The refusal says the mail probably did send and to check the spam folder, which is both more useful and more honest than a bare 429.

The claim that keying on customer id also solved test isolation was wrong, and the tests caught it. resetDb truncates with RESTART IDENTITY, so every integration test's first customer is id 1: three tests that each sent once left the fourth starting at its limit, and two tests failed on a 429 they never asked for. A "fresh customer per test" is a fresh row with a recycled identity. The limiter now has an explicit exported store the suite clears between tests, and the comment that claimed otherwise has been corrected rather than left to mislead the next reader.

Verification: seven integration tests covering the unauthenticated refusal, the send, the new token invalidating the old one - asserted through the endpoint that would honour the stale link rather than by counting rows - the new link actually verifying, the already-verified refusal, the allowance stopping the fourth send rather than merely reporting it, and one customer's exhausted allowance leaving another's intact. Three end-to-end tests for the button, its confirmation and the message on the fourth click. The 33 integration tests across the three suites this touched all pass, as do the 199 backend unit tests. tsc clean on both sides, ESLint no errors.

Closes #110
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/rateLimit.ts

@@ -1,4 +1,4 @@
-import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
+import rateLimit, { ipKeyGenerator, MemoryStore } from 'express-rate-limit';
 import { Request } from 'express';
 
 // First rate limiting in the codebase. The password-reset endpoints need it
@@ -75,3 +75,52 @@ export const clientErrorLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: 'too many reports' }
 });
+
+// Resending a verification email makes the server send mail on request, which
+// is the same class of endpoint as password reset and needs the same treatment.
+//
+// Keyed on the customer id, which is tighter than either limiter above and
+// sidesteps the IPv6 problem of #84 entirely: the caller is signed in, so there
+// is an identity better than an address to count against, and no amount of
+// moving within a delegated prefix changes it. It also means one customer
+// cannot spend anyone else's allowance, which keying on IP would allow.
+//
+// It does NOT make the store's process-wide lifetime a non-issue for tests, as
+// was assumed at first. resetDb truncates with RESTART IDENTITY, so every
+// integration test's first customer is id 1 and they all share one bucket:
+// three tests that each send once exhaust the allowance for the fourth. The
+// store below is explicit and exported so a test can clear it, rather than
+// tests being written around an allowance they cannot see.
+//
+// Must be mounted *after* requireCustomer. Before it, req.customerId is
+// undefined and every anonymous caller would share a single bucket — the same
+// collapse the passwordResetRequestLimiter comment warns about.
+export function keyByCustomer(req: Request): string {
+  return `customer:${req.customerId ?? 'anonymous'}`;
+}
+
+// Three an hour is generous for someone who genuinely lost the mail, and
+// useless to anybody hammering it. The window is longer than the 15 minutes
+// used above because the failure it guards against is slower: a verification
+// link lasts 24 hours, so there is no reason to want a fourth inside an hour.
+const VERIFICATION_RESEND_WINDOW_MS = 60 * 60 * 1000;
+const VERIFICATION_RESEND_MAX = 3;
+
+// Exported only so the integration suite can clear it between tests. See the
+// note above: recycled customer ids make the allowance leak across tests.
+export const verificationResendStore = new MemoryStore();
+
+export const verificationResendLimiter = rateLimit({
+  windowMs: VERIFICATION_RESEND_WINDOW_MS,
+  limit: VERIFICATION_RESEND_MAX,
+  keyGenerator: keyByCustomer,
+  store: verificationResendStore,
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  // Says what actually happened rather than only that a limit was hit. The mail
+  // almost certainly did send, so "check your spam folder" is both the more
+  // useful instruction and the more honest one.
+  message: {
+    error: 'we have already sent several verification emails recently. Check your spam folder, and try again later.'
+  }
+});