Add email-nag plugin: collect+verify missing Authentik emails over Matrix DM

One-shot MAS-migration helper. DMs a fixed target set of users with no
email on file in Authentik, collects an address, verifies inbox ownership
with an emailed 6-digit code (via Resend), and only writes it back to
Authentik after confirmation — so a mistyped/hostile address never becomes
a live recovery address. FSM state persists in email_nag_prompts so
restarts never re-nag anyone done or mid-flow.

- Per-user rolling-1h cap on verification emails (EMAIL_NAG_MAX_SENDS_PER_HOUR)
  to prevent send-spam abuse.
- Misconfig disables only this plugin instead of aborting bot startup.

.env.example

@@ -128,3 +128,17 @@ MINIFLUX_MAX_PER_POLL=5        # max entries per feed per poll (default 5)
 RATELIMIT_WEATHER=5
 RATELIMIT_TRANSLATE=20
 RATELIMIT_CONCERTS=10
+
+# ---- Email Nag (one-shot migration helper: collect+verify missing Authentik emails over Matrix DM) ----
+FEATURE_EMAIL_NAG=             # set to "true" to enable
+EMAIL_NAG_AUTHENTIK_URL=       # e.g. https://authentik.parodia.dev
+EMAIL_NAG_AUTHENTIK_TOKEN=     # Authentik service-account token, scoped to user write
+EMAIL_NAG_RESEND_KEY=          # Resend API key (sends the verification code)
+EMAIL_NAG_MAIL_FROM=           # e.g. Parodia <noreply@mail.parodia.dev>
+EMAIL_NAG_HOME_DOMAIN=         # Matrix server name, e.g. parodia.dev (builds @user:domain)
+EMAIL_NAG_TARGETS=             # comma-separated Authentik usernames to nag (== Matrix localparts)
+EMAIL_NAG_CODE_TTL=30m         # verification code lifetime (default 30m)
+EMAIL_NAG_MAX_ATTEMPTS=5       # wrong-code attempts before restart (default 5)
+EMAIL_NAG_MAX_SENDS_PER_HOUR=5 # cap on verification emails per user per rolling hour (anti-spam, default 5)
+EMAIL_NAG_SWEEP_DELAY=2s       # delay between DMs during the startup sweep (default 2s)
+EMAIL_NAG_REPROMPT_COOLDOWN=   # re-nag non-responders whose last prompt is older than this (e.g. 72h); empty/0 = nag once