Add display_name (unique) and email_confirmed_at columns plus matching getters, DTO fields, repo methods (findByDisplayName, update), and migration. Existing auth tests updated to construct User with the new params.
2 cases: existing token's session gets removed; unknown token is a no-op (deleteByToken stays idempotent).