Provide a recovery path for an expired activation link

[zakius]

What happened

An expired activation link leaves the account inactive. Registration with the same email reports success but sends no replacement link. Password reset also cannot recover the account.

What I expected

Confirmed behavior:

• If activation has expired, send a new activation link.
• If the account is active, send an email explaining that the account exists and offering a password reset link.
• Show the same browser message in both cases. Only the email explains the account state.
• Opening the reset link must only display the password form. It must not change the password or consume the token.
• Complete the reset and consume the token only after the user submits a new password and confirms it.
• Opening an activation link must only display a confirmation page. It must not activate the account or consume the token.
• Activate the account and consume the token only after the user selects the confirmation button.

Check that email previews and link scans leave both activation and reset links usable.

Steps to reproduce

1. Enable registration and outgoing email.
2. Register an account and let its activation link expire after 24 hours.
3. Open the expired link.
4. Register again with the same email, then request a password reset.

Additional context

UX and reliability. Local HTTP checks confirmed the account remains inactive with an expired link and no reset token. Verified at commit 560e71f.

[zakius]

Fixed by #826, merged to staging.