chore(auth): non-blocking follow-ups from final review

- /api/stats: add verifyCsrf middleware (defense-in-depth; no-op for GETs)
- VerifyEmailPage: useRef guard to prevent React StrictMode double-fire of
  the single-use verify token in dev
- router.tsx: route-level code splitting via React.lazy + Suspense; initial
  bundle drops from 397 KB to 224 KB with per-route chunks (0.3–14 KB each)
- e2e: wait for verify-email completion before login; bump Account-menu
  timeout to handle Vite cold-chunk compile

packages/backend/src/app.ts

@@ -32,7 +32,7 @@ export function createApp(db: Db): Express {
   app.use('/api/lessons', requireAuth, verifyCsrf, lessonsRouter(db));
   app.use('/api', requireAuth, verifyCsrf, cardsRouter(db));
   app.use('/api/sessions', requireAuth, verifyCsrf, sessionsRouter(db));
-  app.use('/api/stats', requireAuth, statsRouter(db));
+  app.use('/api/stats', requireAuth, verifyCsrf, statsRouter(db));
   app.use('/api/admin/users', requireAuth, requireRole('sysadmin'), verifyCsrf, adminUsersRouter(db));
 
   // Static frontend in production