feat: 6-digit email verification code, fix missing script+route includes

public/js/pages/verify.js

@@ -0,0 +1,26 @@
+const VerifyPage = {
+  async render() {
+    return `<div class="pub-card"><div class="logo"><i class="fas fa-envelope"></i><h2>邮箱验证</h2><p>请输入邮件中的6位验证码</p></div>
+      <form id="verify-form"><div class="form-group"><input id="vf-code" placeholder="6位验证码" required maxlength="6" minlength="6" pattern="[0-9]{6}" autofocus></div>
+      <div id="vf-msg" class="hidden"></div>
+      <button type="submit" class="btn btn-p btn-lg w-full"><i class="fas fa-check"></i> 验证</button></form>
+      <div style="margin-top:14px;text-align:center;font-size:13px"><a href="#/login" style="color:var(--p);text-decoration:none">返回登录</a></div>
+    </div>`;
+  },
+  mount() {
+    document.getElementById('verify-form').addEventListener('submit', async e => {
+      e.preventDefault();
+      const code = document.getElementById('vf-code').value.trim();
+      const msg = document.getElementById('vf-msg');
+      try {
+        const r = await API.post('/auth/verify-email', { code });
+        msg.className = 'alert alert-s'; msg.textContent = r.message || '验证成功';
+        msg.classList.remove('hidden');
+        setTimeout(() => location.hash = '#/login', 2000);
+      } catch(ex) {
+        msg.className = 'alert alert-e'; msg.textContent = ex.message;
+        msg.classList.remove('hidden');
+      }
+    });
+  }
+};