feat(admin): mark a WorkOS email verified from the admin

[bordoni]

When a customer's sign-in code doesn't arrive, often because of a filter or a slow mailbox, support has no supported way to mark the WorkOS email verified, even after confirming who the person is another way.

Stacked on #77 (feat/workos-capabilities).

Changes

• New POST /wp-json/workos/v1/admin/users/{id}/verify-email, where {id} is the WP user ID, like the password-reset route. It looks up the linked WorkOS user, returns already_verified: true without an update when the email is already verified, and otherwise calls update_user with email_verified: true.
• Gated by a new workos_verify_email capability that maps to edit_users, so nobody can verify their own email by default. None of the Plugin capabilities for WorkOS user management #65 capabilities fit: workos_change_email maps to edit_user, which every user has on their own account.
• Logs email.admin_verified with the WorkOS email and initiator_id, and clears the user-edit panel's cached WorkOS user.
• 404 for an unknown user, 409 when the user isn't linked, and 502 workos_api_error when WorkOS fails, so a WorkOS 401 isn't read as the caller's own.
• WorkOS Users screen: a "Mark email verified" button on rows whose email isn't verified, when the caller can use it (can_verify_email on each row). It asks for confirmation and marks the row verified in place. Rows with no linked WP user don't get it.
• User-edit WorkOS panel: the same button next to an unverified email. It reuses the shared admin script and confirm modal already on that screen.
• docs/capabilities.md, README and AGENTS.md updated.

Verified

• New AdminUsersVerifyEmailTest: logged out, an editor and a user acting on themselves get 403 with no WorkOS call. A role granted workos_verify_email succeeds. Unknown user is 404, unlinked is 409. Already verified is a no-op with no update and no log row. Success sends {"email_verified": true}, logs the initiator and clears the cache. WorkOS errors on the lookup or the update return 502 with no log row. The panel button shows only for an unverified email and only with the capability.
• The CapabilitiesTest matrix covers workos_verify_email (admins only, same as edit_users), and AdminUsersRestApiTest checks can_verify_email.
• wpunit: 802 tests plus the 15 in the constants group pass. phpcs, phpstan, bun run build and tsc --noEmit pass.
• Not yet checked in a browser.

Screenshots

Closes #66