GSOC-E2E-3: Add Mailpit-based email verification for signup e2e test

[Geethegreat]

Issue:

Fixes #

Completes the // TODO: on next PR, email verification left in signup.spec.ts, using a local SMTP mail catcher (Mailpit) instead of either hitting real Mailgun or bypassing verification, the app sends a real email, the test reads it back and clicks the real link, exactly like a real user would.

Demo:

flow-3-email.mp4

Changes:

• server/utils/mail.ts: added an EMAIL_TRANSPORT=smtp option that sends over plain SMTP to localhost:1025 instead of Mailgun's API opt-in, zero behavior change when unset.
• .env.e2e: added EMAIL_SENDER and EMAIL_TRANSPORT=smtp overrides for e2e runs.
• e2e/helpers/mailpit.ts (new): getVerificationLink(email) — polls Mailpit's REST API until the verification email arrives, then extracts the real /verify?t= link from its HTML body.
• e2e/specs/signup.spec.ts: after signup, fetches the email via the new helper, navigates to the real verification link, and confirms verified: 'verified' via /editor/session.
• playwright.config.ts: added Mailpit as a second webServer entry (auto-started/reused locally; requires the binary — winget install axllent.mailpit / brew install mailpit / Docker).
• .github/workflows/e2e.yml: added a mailpit service container (axllent/mailpit) so CI has the same mail catcher without any local install step.

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #123
• meets the standards outlined in the accessibility guidelines