Add e2e auth test suite, retention crons, and email-verification UX

- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
  Fastify app against a disposable Dockerized Postgres (never a real DB) and
  covers signup/login/lockout/rate limits, CSRF (incl. forged-token
  rejection), logout, password reset, email verification, the superadmin
  verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
  don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
  tokens, login attempts, tool usage, contact messages, audit log) +
  sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
  with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
  document login-attempt/tool-usage retention in the Privacy Policy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/test-e2e/global-setup.ts

@@ -0,0 +1,67 @@
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import pg from 'pg';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import {
+  E2E_CONTAINER,
+  E2E_DATABASE_URL,
+  E2E_DB_NAME,
+  E2E_DB_PASSWORD,
+  E2E_DB_PORT,
+} from './env';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MIGRATIONS = path.resolve(__dirname, '../../../packages/db/migrations');
+
+async function waitForPostgres(timeoutMs = 60_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  let lastErr: unknown;
+  while (Date.now() < deadline) {
+    const client = new pg.Client({ connectionString: E2E_DATABASE_URL });
+    try {
+      await client.connect();
+      await client.query('select 1');
+      await client.end();
+      return;
+    } catch (err) {
+      lastErr = err;
+      await client.end().catch(() => {});
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+  throw new Error(`e2e postgres did not become ready in ${timeoutMs}ms: ${lastErr}`);
+}
+
+export default async function setup() {
+  try {
+    execSync(`docker rm -f ${E2E_CONTAINER}`, { stdio: 'ignore' });
+  } catch {
+    // no stale container — fine
+  }
+
+  execSync(
+    `docker run --rm -d --name ${E2E_CONTAINER} -p ${E2E_DB_PORT}:5432 ` +
+      `-e POSTGRES_PASSWORD=${E2E_DB_PASSWORD} -e POSTGRES_DB=${E2E_DB_NAME} postgres:16-alpine`,
+    { stdio: 'inherit' },
+  );
+
+  try {
+    await waitForPostgres();
+
+    const pool = new pg.Pool({ connectionString: E2E_DATABASE_URL, max: 2 });
+    try {
+      await migrate(drizzle(pool), { migrationsFolder: MIGRATIONS });
+    } finally {
+      await pool.end();
+    }
+  } catch (err) {
+    execSync(`docker rm -f ${E2E_CONTAINER}`, { stdio: 'ignore' });
+    throw err;
+  }
+
+  return () => {
+    execSync(`docker rm -f ${E2E_CONTAINER}`, { stdio: 'ignore' });
+  };
+}