Verify a new user account

Public endpoint — no authentication required.

This is the destination of the verification link emailed to new users. It is called by the user’s browser, not by the partner system.

On success:

1. A TREVEX user account is created from the draft
2. A set-password email is sent (link valid for 48 hours)
3. All KYB requests linked to this draft are unblocked and move to under_review