fix: Email validation tokens

[benjackwhite]

Problem

Some investigation around email resetting revealed a few less-than-perfect things. Nothing major from what I can see but confusing APIs that make it look like you can do bad things (which you can't)

Changes

• Adds some missing tests to verify a bunch of things such as not being able to use someone else's token or re-use a token for verifying a pending email (there were some tests here but not enough to immediately confirm some security doubts)
• Fix an issue with the login_timestamp not being included in the token validation (which is what was allowing an email verification to be used multiple times) - this anyway had a 24 hour limit but now it is even more restrictive
• Makes the unauthenticated endpoints non-detail specific which fixes confusion around where the uuid was coming from.

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Does this work well for both Cloud and self-hosted?

How did you test this code?

[github-actions]

Size Change: 0 B

Total Size: 1.11 MB

ℹ️ View Unchanged

Filename	Size
frontend/dist/toolbar.js	1.11 MB

_{compressed-size-action}

[posthog-bot]

📸 UI snapshots have been updated

1 snapshot changes in total. 0 added, 1 modified, 0 deleted:

• chromium: 0 added, 1 modified, 0 deleted (diff for shard 1)
• webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.

[zlwaterfield]

This looks good - thanks for making this change.

One thing to note: this will invalidate all existing tokens, which is mildly annoying to users - we may get increased support requests related to this in the next 24 hours.

[posthog-bot]

📸 UI snapshots have been updated

1 snapshot changes in total. 0 added, 1 modified, 0 deleted:

• chromium: 0 added, 1 modified, 0 deleted (diff for shard 1)
• webkit: 0 added, 0 modified, 0 deleted

Triggered by this commit.

👉 Review this PR's diff of snapshots.