GoTrue v2.186 only loads MAILER_TEMPLATES_* over HTTP(S) (local file/file:// paths are rejected), so serve the token_hash confirmation template from the app's public dir for GoTrue to fetch and cache.