fix: harden booking and meeting flows

collections/Customers.ts

@@ -1,4 +1,6 @@
 import type { CollectionAfterChangeHook, CollectionBeforeChangeHook, CollectionConfig } from "payload";
+import { APIError } from "payload";
+import { allowVerificationEmail } from "@/lib/auth/verificationRateLimit";
 import { isAdmin, isAdminFieldLevel } from "@/access";
 import { EMAIL_VERIFICATION_TTL_MS, generateVerificationToken, hashVerificationToken, verificationExpiryISO } from "@/lib/auth/verification";
 import { verificationEmail } from "@/lib/email/authTemplates";
@@ -35,6 +37,10 @@ const issueVerificationToken: CollectionBeforeChangeHook = ({ data, originalDoc,
     data.email !== originalDoc.email;
   if (operation !== "create" && !emailChanged) return data;
 
+  if (!allowVerificationEmail(req, String(data.email ?? originalDoc?.email ?? ""), originalDoc?.id)) {
+    throw new APIError("Zu viele Bestätigungs-E-Mails. Bitte versuche es später erneut.", 429, undefined, true);
+  }
+
   const token = generateVerificationToken();
   data.emailVerified = false;
   data.emailVerificationTokenHash = hashVerificationToken(token);
@@ -46,6 +52,7 @@ const issueVerificationToken: CollectionBeforeChangeHook = ({ data, originalDoc,
 const sendVerificationEmail: CollectionAfterChangeHook = async ({ doc, req }) => {
   const token = req.context.pendingVerificationToken;
   if (typeof token !== "string") return doc;
+  delete req.context.pendingVerificationToken;
   try {
     const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
     await sendEmail(