Add email-nag plugin: collect+verify missing Authentik emails over Matrix DM

One-shot MAS-migration helper. DMs a fixed target set of users with no
email on file in Authentik, collects an address, verifies inbox ownership
with an emailed 6-digit code (via Resend), and only writes it back to
Authentik after confirmation — so a mistyped/hostile address never becomes
a live recovery address. FSM state persists in email_nag_prompts so
restarts never re-nag anyone done or mid-flow.

- Per-user rolling-1h cap on verification emails (EMAIL_NAG_MAX_SENDS_PER_HOUR)
  to prevent send-spam abuse.
- Misconfig disables only this plugin instead of aborting bot startup.

main.go

@@ -195,6 +195,9 @@ func main() {
 	spaceInviter := plugin.NewSpaceInviterPlugin(client)
 	registry.Register(spaceInviter)
 
+	// Email nag (DM users missing an Authentik email; verify + write it back)
+	registry.Register(plugin.NewEmailNagPlugin(client))
+
 	// Initialize all plugins
 	if err := registry.Init(); err != nil {
 		slog.Error("plugin init failed", "err", err)