FixRe-throw AuthError so 403 (email not verified) reaches the client
—PR #23 added the email_verified check inside the try block, so the catch re-wrapped its 403 as a 401 with message 'Token verification failed (Email not verified)'. The client only redirects on a literal 403, so the bounce to /verify-email never fired. Re-throw AuthError as-is and only wrap genuine SDK verification failures.