fix(auth): surface email-not-verified error and detect needsVerification on signup

- mana-auth login route: catch Better Auth's email verification error and
  return 403 EMAIL_NOT_VERIFIED instead of 401 Invalid credentials
- shared-auth signUp: detect emailVerified:false in register response and
  return needsVerification:true so the UI shows the verification prompt
- shared-auth-ui LoginPage: map INVALID_CREDENTIALS error code to friendly message
- shared-i18n: add invalidCredentials translation (de/en)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/mana-auth/src/routes/auth.ts

@@ -131,6 +131,14 @@ export function createAuthRoutes(
 
 			return c.json(response);
 		} catch (error) {
+			// Check if Better Auth rejected login due to unverified email
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			const isEmailNotVerified =
+				errorMessage.includes('email') && errorMessage.toLowerCase().includes('verif');
+			if (isEmailNotVerified) {
+				return c.json({ error: 'Email not verified', code: 'EMAIL_NOT_VERIFIED' }, 403);
+			}
+
 			security.logEvent({
 				eventType: 'LOGIN_FAILURE',
 				ipAddress: ip,