Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed

Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.

apps/dashboard/svelte.config.js

@@ -26,7 +26,8 @@ const config = {
           'self',
           'https://assets.cdn.clsrio.com',
           'https://cdnjs.cloudflare.com',
-          'https://eu-assets.i.posthog.com'
+          'https://*.i.posthog.com',
+          'https://*.senja.io'
         ],
         'style-src': [
           'self',
@@ -59,7 +60,8 @@ const config = {
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.classroomio.com',
-          'wss://*.supabase.co'
+          'wss://*.supabase.co',
+          'https://*.senja.io'
         ],
         'object-src': ['none'],
         'base-uri': ['self'],
@@ -73,7 +75,8 @@ const config = {
           'self',
           'https://assets.cdn.clsrio.com',
           'https://cdnjs.cloudflare.com',
-          'https://eu-assets.i.posthog.com'
+          'https://*.i.posthog.com',
+          'https://*.senja.io'
         ],
         'style-src': [
           'self',
@@ -106,7 +109,8 @@ const config = {
           'http://localhost:54321',
           'ws://localhost:54321',
           'wss://*.supabase.co',
-          'wss://*.classroomio.com'
+          'wss://*.classroomio.com',
+          'https://*.senja.io'
         ],
         'object-src': ['none'],
         'base-uri': ['self'],