Although the defaults don't require a verified email address, it's easy to lock yourself out by accident by configuring auth.require-email-verification or auth.email-domains before setting up email. Just force-verify the initial/setup account's address.

Went through setup on a fresh install, saw address verify.