fix(api): preserve verification token on resend mail failure

[cursor]

Bug and impact

POST /v1/agent/verify-email/resend rotated an unverified account's stored verification token before confirming email delivery. If Resend/Postmark returned an error or was unavailable, the endpoint still returned the neutral success message while the previous usable verification link was invalidated, leaving pending signup credits locked until a later successful resend.

Root cause

sendEmail() returned false on delivery failure, but sendVerificationEmail() discarded that result and always logged success. The resend path updated verifyToken/verifyTokenExpiry and launched the send without any failure compensation.

Fix

• Make verification email sending return its delivery result.
• Preserve anti-enumeration response behavior by keeping resend fire-and-forget.
• On background delivery failure, guard-rollback only the just-minted token to the previous token/expiry so newer resends are not clobbered.
• Add a regression test for slow provider failure: the route returns neutral 200 before the provider completes, then restores the previous token.

Validation

• npm run build
• node tests/verify-resend.test.mjs