feat(client): Smooth out the verification flow.

* The original tab always automatically completes the oauth flow if it is open when the email is verified.
* If a second tab is opened in the same browser, show the user a link to continue back to the RP.
* If the user verifies in a second browser, show the service name, but do not allow the user to click back to the RP.

fixes #1723
I think there's a code path where the user could get here from a signin flow with an unverified account, but close enough.