Send signup verification codes to new users before session start

Your signup requests land without verified emails, causing fake accounts, failed activations, and delayed onboarding. Users receive verification codes to reduce fraud and finish activation before the next session.