In the future, we're going to open a generous free plan on the cloud version, so we need to limit the number of spam accounts created.

Let's introduce email verification for people that don't use Microsoft/Google login.

Pre-requisite: introduce a server-level environment variable IS_EMAIL_VERIFICATION_REQUIRED (defaults to false), as some people self-hosting might not want to go through that (means they have to setup an email server!).

Signup Process

• Set isEmailVerified to false initially (already the case)
• Generate a unique email verification token.
• Store the token in appToken
• Send Email containing the verification link
• Create a page to handle verification requests, which sets isEmailVerified to true and then automatically login the user

Note: users joining an existing workspace through an invite shouldn't have to validate their email again

Signin Process

During signin, check the isEmailVerified field.
If isEmailVerified is false, prevent login and prompt the user to verify their email.
Optionally, offer to resend the verification email.

Note: we already have the emailVerified column on user but it wasn't used - we might want to drop it or rename it to isEmailVerified to be consistent with other columns in the codebase
Todo during deploy: script/sql query to set emailVerified=true for every user that ever had a valid subscription (credit card = strong verification, we can consider the email is most likely to be valid)

Email content

We already have templates for Twenty emails (e.g. user invites)

https://www.figma.com/design/xt8O9mFeLl46C5InWwoMrN/Twenty?node-id=44465-119474&node-type=frame&t=L4Zw8NIeonoYkIdd-11