fix(auth): require verified email for domain access

变更摘要：

- 修复 EMAIL_DOMAIN 准入策略，未验证邮箱不再因域名匹配被放行

- 新增回归测试，覆盖 OIDC 场景下 email_verified=false 的拒绝行为

- 保持修复范围收敛，仅调整策略判定与对应测试

关键文件：

- server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java

- server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java

server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java

@@ -15,7 +15,7 @@ public class EmailDomainAccessPolicy implements AccessPolicy {
 
     @Override
     public AccessDecision evaluate(OAuthClaims claims) {
-        if (claims.email() == null) return AccessDecision.DENY;
+        if (claims.email() == null || !claims.emailVerified()) return AccessDecision.DENY;
         String domain = claims.email().substring(claims.email().indexOf('@') + 1);
         return allowedDomains.contains(domain.toLowerCase())
             ? AccessDecision.ALLOW : AccessDecision.DENY;

server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java

@@ -36,6 +36,13 @@ class AccessPolicyTest {
         assertThat(policy.evaluate(claims)).isEqualTo(AccessDecision.DENY);
     }
 
+    @Test
+    void emailDomainPolicy_deniesUnverifiedEmail() {
+        var policy = new EmailDomainAccessPolicy(Set.of("company.com"));
+        var claims = new OAuthClaims("oidc", "123", "user@company.com", false, "user", Map.of());
+        assertThat(policy.evaluate(claims)).isEqualTo(AccessDecision.DENY);
+    }
+
     @Test
     void providerAllowlistPolicy_allowsMatchingProvider() {
         var policy = new ProviderAllowlistAccessPolicy(Set.of("github"));