Registration now rolls back the just-created user (token cascades) and returns a clear 502 EMAIL_SEND_FAILED if the verification email can't be sent, instead of a 500 leaving an unverifiable orphan account. resend-verification and forgot-password swallow mail failures (log + still return generic 200) so a broken mailer can't break the flow or leak account existence. Adds regression tests.