Implement email verification lockout and missing phase 2 items

api/routes/auth.js

@@ -80,6 +80,15 @@ router.post('/login', async (req, res) => {
         const isMatch = await bcrypt.compare(password, user.password_hash);
         if (!isMatch) return res.status(401).json({ error: 'Invalid credentials' });
 
+        if (!user.is_email_verified) {
+            const createdAt = new Date(user.created_at);
+            const now = new Date();
+            const daysSinceCreation = (now.getTime() - createdAt.getTime()) / (1000 * 60 * 60 * 24);
+            if (daysSinceCreation > 5) {
+                return res.status(403).json({ error: 'Account locked. Please verify your email address to continue.', needsVerification: true });
+            }
+        }
+
         const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, JWT_SECRET, { expiresIn: '14d' });
         res.cookie('token', token, { httpOnly: true, maxAge: 14 * 24 * 60 * 60 * 1000, secure: false, sameSite: 'lax' });