Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed

Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.

apps/dashboard/src/routes/onboarding/+page.svelte

@@ -108,14 +108,6 @@
     fields.locale = newSelectedId;
   }
 
-  async function setMetaData() {
-    if (!env.PUBLIC_IP_REGISTRY_KEY) return;
-
-    const response = await fetch(`https://api.ipregistry.co/?key=${env.PUBLIC_IP_REGISTRY_KEY}`);
-    const payload = await response.json();
-    fields.metadata = payload;
-  }
-
   function setOrgSiteName(orgName: string | undefined, isTouched: boolean) {
     if (!orgName || isTouched) return;
 
@@ -193,8 +185,6 @@
       // Submit filled
 
       // Set extra metadata based off location
-      await setMetaData();
-
       await supabase
         .from('profile')
         .update({