Verify user's email address

Verifies a user's email address using the verification key from the email link. Returns 200 if email is successfully verified (idempotent - also returns 200 if already verified). Returns 404 if the verification token is invalid or not found. Returns 410 if the token has expired - a new verification email is automatically sent in this case. Returns 400 for malformed requests (invalid GUID format, missing required fields).