Fire the e-mail verification exactly once per token

React StrictMode double-invokes effects in development; the second
POST consumed-token 400 could win the state race and show an error
for a successful verification (flaked in CI, passed locally). A ref
guards the single-use call; Playwright test-results are ignored.

Part of #20

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -7,3 +7,4 @@ coverage/
 !.env.example
 .DS_Store
 .pnpm-store/
+test-results/

apps/web/src/pages/auth/VerifyEmailPage.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Link, useSearchParams } from 'react-router-dom';
 
@@ -14,12 +14,17 @@ export function VerifyEmailPage(): React.JSX.Element {
   const [resent, setResent] = useState(false);
 
   const token = params.get('token');
+  // Tokens are single-use: the effect must fire exactly once per token,
+  // also under React StrictMode's double-invocation in development.
+  const firedFor = useRef<string | null>(null);
 
   useEffect(() => {
     if (!token) {
       setState('error');
       return;
     }
+    if (firedFor.current === token) return;
+    firedFor.current = token;
     apiPost('/auth/verify-email', { token })
       .then(() => setState('success'))
       .catch(() => setState('error'));

apps/web/test-results/.last-run.json

@@ -1,4 +0,0 @@
-{
-  "status": "passed",
-  "failedTests": []
-}