guard: routes - the reset link, the confirmation link, Send the link again

password-reset, agreed 2026-10-13 ("the e-mail must be confirmed") and
settled 2026-10-17 ("Без подтверждения слать": notifications go to an
unconfirmed address, a reset link only to a confirmed one); mockups
2f5f5b2.

Public, as /setup/ is: /login/reset (the form that asks for a link),
/login/reset/<token> (the new password from the link), /confirm/<token>
(the address confirmed from its link) - each link is opened from a mail,
signed in or not. Behind a session: POST /account/email/confirm, Send the
link again on Account.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/guard_routes_test.go

@@ -47,7 +47,7 @@ var routes = struct{ always, inbound, dmarc []string }{
 		"GET /server/users/{uid}/delete", "POST /server/users/{uid}/delete",
 		"GET /server/settings", "POST /server/settings", "POST /server/settings/dns-recheck",
 		"GET /server/components",
-		"GET /account", "POST /account/profile", "POST /account/password",
+		"GET /account", "POST /account/profile", "POST /account/password", "POST /account/email/confirm",
 		"GET /help",
 	},
 	inbound: []string{
@@ -163,7 +163,8 @@ func TestRoutesFollowNavigation(t *testing.T) {
 	}
 
 	// What stays as it was.
-	for _, p := range []string{"/healthz", "/license", "/static/panel.css", "/setup/token", "/login", "/logout"} {
+	for _, p := range []string{"/healthz", "/license", "/static/panel.css", "/setup/token", "/login", "/logout",
+		"/login/reset", "/login/reset/token", "/confirm/token"} {
 		if got := answers(public, http.MethodGet, p); got == "" || got == "/" {
 			t.Errorf("GET %s is no longer a public route", p)
 		}