test(auth): prove email token lifecycle

Reject verification-link replay and cover real Identity token expiry, replay, email change, and custom username preservation on SQLite.

JobTrackerApi/Controllers/AuthController.cs

@@ -1019,7 +1019,7 @@ public sealed class AuthController : ControllerBase
         if (token.Length == 0) return BadRequest("Token is required.");
 
         var user = await _users.FindByIdAsync(userId);
-        if (user is null) return BadRequest("Invalid or expired link.");
+        if (user is null || user.EmailConfirmed) return BadRequest("Invalid or expired link.");
 
         var res = await _users.ConfirmEmailAsync(user, token);
         if (!res.Succeeded)