Registration accepts emails with no dot in the domain

The registration email format check is supposed to require a real domain with a dot in it (user@example.com). Right now it accepts garbage like user@localhost or user@nodotatall as a "valid" email -- letting obviously-malformed addresses into the system, which in a real deployment means bounced verification emails, unreachable accounts, and bad data quality that downstream features (password reset, receipts, notifications) all have to deal with.

The email-validation regex is meant to require a literal "." between the "@" and the end of the string, but the dot in the pattern is unescaped -- in regex, an unescaped "." matches any single character, not specifically a literal dot -- so the "must contain a dot" requirement is effectively gone; almost any non-empty string of the right shape after the "@" satisfies it.

curl -s -X POST http://localhost:8082/register -H 'Content-Type: application/json'
-d '{"email":"user@localhost","password":"correct-horse-battery"}'

Expected: 400 "a valid email is required"

Actual: 201, account created

This is a classic "unescaped regex metacharacter" mistake -- "." unescaped means "any character," so a pattern meant to enforce a literal dot silently stops enforcing it, while still compiling as a perfectly valid regex with no error of any kind.

Look at emailRe's pattern character by character around the segment that's supposed to require a domain suffix, and compare it against how the same character is escaped everywhere else a literal dot is meant, versus where it isn't.