feat: resend account activation email endpoint

[hhvrc]

Summary

Adds a user-facing action to re-send the account activation email, so users who never received (or lost) their activation email can request a new one. No database migration required — it reuses the existing UserActivationRequest table.

This is the first, deliberately small slice of a larger email-features effort (admin send-any-email-type, list email types, and an upstream-failure retry queue will follow in separate PRs).

Endpoint

POST /{version}/account/activate/resend

{ "email": "user@example.com" }

Always returns a generic 200 OK (LegacyEmptyResponse).

Behavior

• Rotates the activation token on every resend (invalidating any previously sent link) and persists it before sending, so the link in the new email always matches the stored hash.
• Creates an activation request if an unactivated account doesn't have one yet (e.g. legacy data or a failed initial send), so the user can still complete activation.
• Silently no-ops for unknown, already-activated, or deactivated accounts and always returns a generic 200 — the endpoint can't be used to probe which emails are registered or their activation state.
• Rate limited under the existing auth policy (mirrors POST /account/reset).
• Increments UserActivationRequest.EmailSendAttempts for observability (the column already existed and was unused).

Tests

Added integration tests (MailTests.cs, delivered via the Mailpit SMTP test server):

• ResendActivation_UnactivatedUser_SendsWorkingActivationEmail — create-request path; the resent link actually activates the account.
• ResendActivation_RotatesToken_PreviousLinkInvalidated — after a resend, the original token returns 400 and the fresh token returns 200.
• ResendActivation_AlreadyActivatedUser_Returns200_AndSendsNoEmail
• ResendActivation_UnknownEmail_Returns200_AndSendsNoEmail

All 4 pass locally.

🤖 Generated with Claude Code

---

[stage-review]

Ready to review this PR? Stage has broken it down into 4 individual chapters for you:

	Title
1	Define account activation resend service interface
2	Implement activation token rotation and email logic
3	Expose resend activation endpoint
4	Verify activation resend and token rotation

_{Chapters generated by Stage for commit 105d509 on Jun 24, 2026 7:58am UTC.}