Add e2e auth test suite, retention crons, and email-verification UX

- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
  Fastify app against a disposable Dockerized Postgres (never a real DB) and
  covers signup/login/lockout/rate limits, CSRF (incl. forged-token
  rejection), logout, password reset, email verification, the superadmin
  verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
  don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
  tokens, login attempts, tool usage, contact messages, audit log) +
  sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
  with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
  document login-attempt/tool-usage retention in the Privacy Policy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/db/src/index.ts

@@ -35,7 +35,14 @@ export function getPool(): pg.Pool {
   // Strip sslmode from the URL so our explicit `ssl` option fully controls TLS behavior.
   // Without this, pg merges URL-derived settings which can conflict with the options below.
   let ssl: pg.PoolConfig['ssl'];
-  if (ca) {
+  if (process.env.DATABASE_SSL === 'disable') {
+    // Explicit opt-out for local dev/test databases that don't speak TLS at all (e.g. a
+    // disposable Docker Postgres). Refused in production — prod must always verify TLS.
+    if (isProd) {
+      throw new Error('DATABASE_SSL=disable is not allowed in production');
+    }
+    ssl = false;
+  } else if (ca) {
     // Verified TLS against the managed-DB CA — the correct posture everywhere.
     ssl = { ca, rejectUnauthorized: true };
   } else if (isProd) {