Summary

• Added role validation for ?roles= query parameter in VerifyEmail HTTP handler
• Roles are now checked against user's stored roles using validators.IsValidRoles()
• Prevents privilege escalation via URL manipulation

Test plan

• Verify email verification with no roles param works (uses user's stored roles)
• Verify email verification with valid roles subset works
• Verify email verification with unauthorized roles returns 400

Fixes #486