Add pending account provisioning for demoing to not-yet-existing accounts

An admin can now queue up an email address in advance (POST/GET/DELETE
/system/pending-provisioning) with a source user and an optional admin
flag. The moment that email actually verifies a real account - not raw
registration, which proves nothing about ownership - it gets a deep copy
of the source user's per-user API keys and every company they own
(company profile, aliases, competitors, monitor config, sources, source
documents, monitoring runs, reports, snapshots, detected changes, and
enrichment - not just the company row), plus an email notification
destination for its own address linked to the copied companies.

The clone logic (_copy_row/_clone_company in provisioning_service.py) is
generic over every table it touches via column introspection, so it
doesn't need hand-maintained field lists per model.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/services/auth_service.py

@@ -52,7 +52,7 @@ from app.schemas.auth import (
     TokenResponse,
     VerifyEmailRequest,
 )
-from app.services import ip_throttle_service, security_email_service
+from app.services import ip_throttle_service, provisioning_service, security_email_service
 
 EMAIL_CODE_VALID_HOURS = 36
 
@@ -202,6 +202,11 @@ async def verify_email(db: AsyncSession, client_ip: str, payload: VerifyEmailReq
 
     await code_repo.mark_used(record)
     user.email_verified = True
+    # Verifying an email is the point at which the app can actually trust
+    # someone owns this address - if an admin queued this address up for
+    # pre-provisioning (see provisioning_service), this is where it fires,
+    # never at raw registration (which proves nothing about ownership).
+    await provisioning_service.apply_if_pending(db, user)
     await ip_throttle_service.reset_on_success(db, client_ip, ThrottleAction.VERIFY_EMAIL_CODE)
     await UserSecurityEventRepository(db).create(
         user_id=user.id, event_type=SecurityEventType.EMAIL_VERIFIED, ip_address=client_ip