Auth: updateEmail keeps isEmailVerified from the previous address #79

From the Copilot review of #73 (#73 (comment)), on the isEmailVerified handling from #69 by @TomislavMladenov.

After accounts:update changes the email address, the rebuilt user takes isEmailVerified = prev.isEmailVerified, so a verified flag survives a change of address even when the response reports emailVerified = false. The stale value is persisted and preserved by token refresh.

Suggested fix: honour the response's emailVerified when present, and when it is absent clear the flag whenever the requested address differs from the previous one, with a test for both cases.