Email verification for account setup: shops now confirm their email with a 6-digit code before their site connects, blocking disposable-email and bot signups. Adds honeypot protection on registration. Shop connection tokens are now issued only after email verification.