v0.9.1

GoAlertUser asks for a verification code once per contact method instead
of reissuing one on every reconcile.

GoAlert deletes an unverified SMS, VOICE or EMAIL contact method when its
verification code expires -- deliberately, since v0.31.0. The operator
treated that as drift, recreated the method and sent a fresh code, so a
real person received a repeated text, phone call and email for hours in a
loop only they could end, and each recreation destroyed the GoAlert
message-log evidence that the sends had happened.

Verification is now recorded against method identity and survives the
method being deleted and recreated, so a code is requested once and never
reissued. The person completes it from the GoAlert UI on their own
schedule.

The resting state is stable but not finished: the method sits in GoAlert
unverified, so it will not notify anyone. A ContactMethodsVerified
condition and a VerificationExpired event make that visible instead of
silent. Ready stays True, because the object itself is synced.

Also adds the skip-unverifiable-contact-methods annotation for teams who
would rather the operator never create verifiable methods at all.