Email verification does not block initial access

Blocking access behind email verification is the fastest way to kill activation. Users who sign up expecting to try the product and instead land on a 'check your email' dead end abandon at dramatically higher rates — and most never return. CWE-284 covers improper access control, and this is exactly that: treating unverified users as unauthorized when the threat model doesn't justify it. Every hour a new user spends waiting for a verification email is an hour your competitor keeps them active.

In src/middleware.ts, remove the redirect that blocks unverified users from the app. Let them through and surface a persistent banner instead:

// Allow unverified users into the app
if (!session.user.emailVerified) {
  // Set a header or cookie the layout reads to show the banner
  const response = NextResponse.next();
  response.headers.set('x-email-unverified', '1');
  return response;
}

Render <VerifyEmailBanner /> from src/components/VerifyEmailBanner.tsx in your root layout — dismissible, persistent, non-blocking.