fix(wave): send users with unverified GitHub emails to a dedicated page

[jtourkos]

Frontend half of drips-network/wave#791 (backend: drips-network/wave#792).

Problem

The wave backend now rejects logins and token refreshes with a 403 carrying the
machine-readable code unverified_email when the user's GitHub primary email
address is unverified. Without frontend handling, those users would land on the
generic "Something went wrong" screen (login) or be silently logged out
(refresh) with no explanation.

Changes

• New typed UnverifiedEmailError in call.ts, matched on the backend's
  unverified_email code. The machine-readable code matches now run before the
  bare-word suspended/restricted matches so prose can't shadow them. The
  check is deliberately scoped to call() — the backend only sets this code on
  login and refresh, and matching it in authenticatedCall() would turn an SSR
  load failure into an unhandled 500.
• New /wave/unverified-email page (mirrors /wave/suspended): explains the
  situation, links GitHub's "verifying your email address" docs, and offers
  "Sign in again".
• All three rejection paths route there: the login callback, the client-side
  token refresh (after logout), and the server-side refresh hook (cookies
  cleared, 302).

Notes

Recovery is self-healing: the user verifies the address on GitHub and signs in
again — no app-side verification flow needed.

[Copilot]

Pull request overview

Adds explicit frontend handling for Wave backend’s unverified_email 403s so users with unverified GitHub primary emails are routed to a dedicated explanatory page instead of seeing a generic error or being silently logged out.

Changes:

• Introduces UnverifiedEmailError in the Wave API call layer and ensures machine-readable code matching is evaluated before prose keyword matching.
• Adds a new /wave/unverified-email flow page mirroring the existing suspended flow UX.
• Routes all relevant rejection paths (login callback, client refresh, server refresh hook) to /wave/unverified-email.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/routes/(pages)/wave/(flows)/unverified-email/+page.svelte	New UX page explaining unverified GitHub email requirement and providing a re-login action.
src/routes/(pages)/wave/(flows)/login/callback/perform-login.ts	Re-throws UnverifiedEmailError so the callback page can route appropriately.
src/routes/(pages)/wave/(flows)/login/callback/+page.svelte	Adds client-side routing to /wave/unverified-email when login exchange fails with UnverifiedEmailError.
src/lib/utils/wave/call.ts	Adds UnverifiedEmailError and matches unverified_email before suspended/restricted prose matching in call().
src/lib/utils/wave/auth.ts	Routes client-side token refresh failures with UnverifiedEmailError to /wave/unverified-email after logout.
src/hooks.server.ts	Adds SSR refresh handling: clears auth cookies and redirects to /wave/unverified-email when refresh returns unverified_email.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.