docs(website): unique, changeable, verifiable email addresses (engagement Phase 1b)

Companion to website#<pr>. Records Phase 1b as built, and corrects two things
the plan got wrong before anyone builds on them.

ENGAGEMENT.md
  - Phase 1b step 2 said to pin the index to a case-insensitive collation. Every
    _ci collation MariaDB offers here is also accent-insensitive, so that index
    would refuse jose@x.com once josé@x.com existed and the de-duplication would
    have cleared a legitimate account's address. The as-built block records the
    generated-column design that shipped instead, and the second-order version of
    the same bug that a seeded fixture caught in the de-dupe query itself.
  - §0.6 named two callers of isDuplicateUsername(). There are five, and the
    three it omits fail worse than the two it names.

BACKEND_DESIGN.md — the users table (already stale: it predated the player
account work), plus email_verifications and email_dedupe_report, and the five
new routes.

UPGRADE_NOTES.md — an operator entry, because the de-duplication is the kind of
quiet change this file exists for: nothing breaks, and the affected users find
out the next time they try to reset a password.

api-route-inventory.json — regenerated from the manifest; still ungated.

Co-Authored-By: Claude <noreply@anthropic.com>

website/api-route-inventory.json

@@ -401,6 +401,14 @@
       "method": "DELETE",
       "path": "/api/v1/admin/users/:id/trusted-devices/:deviceId"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/users/email-dedupe-report"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/admin/users/email-dedupe-report/acknowledge"
+    },
     {
       "method": "GET",
       "path": "/api/v1/admin/wiki"
@@ -457,6 +465,14 @@
       "method": "GET",
       "path": "/api/v1/admin/wiki/tags"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/auth/email/verify/:token"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/auth/email/verify/:token"
+    },
     {
       "method": "GET",
       "path": "/api/v1/auth/invite/:token"
@@ -485,6 +501,18 @@
       "method": "GET",
       "path": "/api/v1/auth/me/account"
     },
+    {
+      "method": "PATCH",
+      "path": "/api/v1/auth/me/account/email"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/auth/me/account/email/pending"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/auth/me/account/email/resend"
+    },
     {
       "method": "GET",
       "path": "/api/v1/auth/me/account/identities"