Add e2e auth test suite, retention crons, and email-verification UX

- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
  Fastify app against a disposable Dockerized Postgres (never a real DB) and
  covers signup/login/lockout/rate limits, CSRF (incl. forged-token
  rejection), logout, password reset, email verification, the superadmin
  verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
  don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
  tokens, login attempts, tool usage, contact messages, audit log) +
  sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
  with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
  document login-attempt/tool-usage retention in the Privacy Policy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/vitest.e2e.config.ts

@@ -0,0 +1,17 @@
+import { defineConfig } from 'vitest/config';
+import { E2E_ENV } from './test-e2e/env';
+
+// E2E suite: real Fastify app + real (disposable, Dockerized) Postgres.
+// Kept out of the default `npm test` (unit) config on purpose — requires Docker.
+export default defineConfig({
+  test: {
+    include: ['test-e2e/**/*.e2e.test.ts'],
+    environment: 'node',
+    env: E2E_ENV,
+    globalSetup: ['./test-e2e/global-setup.ts'],
+    // One worker: tests share the app instance and rate-limiter state is IP-partitioned per test.
+    fileParallelism: false,
+    testTimeout: 60_000,
+    hookTimeout: 120_000,
+  },
+});