fix: harden cloud storage security

frontend/verify.html

@@ -265,6 +265,11 @@
         return;
       }
 
+      const cleanUrl = new URL(window.location.href);
+      cleanUrl.searchParams.delete('verifyToken');
+      cleanUrl.searchParams.delete('token');
+      window.history.replaceState({}, document.title, cleanUrl.pathname + cleanUrl.search + cleanUrl.hash);
+
       try {
         const res = await fetch(`/api/verify-email?token=${encodeURIComponent(token)}`);