Public web-only release: SvxPortal front-end + auth backend, install templates and INSTALL.md

Stripped from the internal repo: per-box deploy trees, Go services (nodelist/astmeta/proxy/svxdr),
deploy/sync scripts and all secrets. Config templates for nginx, PHP-FPM, Redis and tmpfiles
live in install/ with CHANGEME placeholders.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

auth/verify.php

@@ -0,0 +1,41 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/lib.php';
+
+$tid = trim((string)($_GET['tid'] ?? ''));
+$token = trim((string)($_GET['token'] ?? ''));
+
+if ($tid === '' || $token === '') {
+  http_response_code(400);
+  echo "Bad request";
+  exit;
+}
+
+$k = rkey("token:verify:$tid");
+$h = redis()->hGetAll($k);
+if (!is_array($h) || empty($h['uid']) || empty($h['hash'])) {
+  http_response_code(400);
+  echo "Invalid or expired token";
+  exit;
+}
+
+if (!hash_equals((string)$h['hash'], token_hash($token))) {
+  http_response_code(400);
+  echo "Invalid token";
+  exit;
+}
+
+$uid = (string)$h['uid'];
+redis()->hSet(acct_key($uid), 'email_verified', '1');
+// Flags: unreg -> reg. An admin must then set normal before the account gets in.
+$f = redis()->hGet(acct_key($uid), 'acct_flags');
+$f = ($f === false || $f === '') ? 1 : ((int)$f & 0x3F);
+redis()->hSet(acct_key($uid), 'acct_flags', (string)((($f & ~1) | 2)));
+redis()->del($k);
+
+header('Content-Type: text/html; charset=utf-8');
+echo "<!doctype html><meta charset='utf-8'><title>Verified</title><body style='font-family:system-ui;background:#000;color:#0ff;padding:20px;'>
+<h2>OK</h2>
+<div>Your e-mail is verified. Your account is now registered and waiting for an admin to approve it &mdash; once that is done you can sign in.</div>
+<div style='margin-top:12px;'><a href='/svxportal/' style='color:#0ff;'>Back to SvxPortal</a></div>
+</body>";