Block unverified users from marking themselves ready

GameDashboardService::toggleReady() now rejects the toggle if the
user's email isn't verified (mirrors the same gate UserChecker already
applies at login). The waiting-room checkbox is disabled client-side
with an explanatory alert and a link to resend the verification email,
and the controller adds a flash error as a server-side fallback if it
somehow gets submitted anyway.

src/Game/Controller/GameController.php

@@ -127,7 +127,12 @@ final class GameController extends AbstractController
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
         if ($request->isMethod('POST') && $request->request->has('toggle_ready')) {
-            $dashboardService->toggleReady($session, $user);
+            if (!$user->isVerified()) {
+                $this->addFlash('error', 'You must verify your email address before you can mark yourself as ready.');
+            } else {
+                $dashboardService->toggleReady($session, $user);
+            }
+
             return $this->redirectToRoute('game', ['session' => $session->getId()]);
         }
 

src/Game/Service/GameDashboardService.php

@@ -290,6 +290,10 @@ final class GameDashboardService
             return false;
         }
 
+        if (!$user->isVerified()) {
+            return false;
+        }
+
         $player = null;
         foreach ($session->getPlayers() as $p) {
             if ($p->getUser() === $user) {