feat(auth): 防账号枚举 — 已注册邮箱发"已注册"提醒,不内联暴露

发码/注册都不再泄露"邮箱是否已注册"(对翻墙工具尤其敏感:已注册=该人是用户)。
- SendCode:邮箱已注册时不发验证码、改发"您已注册请直接登录"邮件,接口统一
  返回 204(注册/未注册无差别)→ 关掉发码侧枚举
- Register:命中已注册(ErrEmailTaken)改回通用 ErrCodeInvalid(与错码一致),
  不再返回"该邮箱已注册"→ 关掉注册侧枚举
- Mailer 接口加 SendAlreadyRegistered(SMTP + Log 两实现)
- 测试:DuplicateEmailConflict 改为断言"已注册不发码 + 强制码也只回通用错误";
  integration 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/mailer.go

@@ -12,6 +12,11 @@ import (
 // be safe for concurrent use; Send is typically invoked from a goroutine.
 type Mailer interface {
 	SendCode(ctx context.Context, to, code string) error
+	// SendAlreadyRegistered notifies an address that it already has an account.
+	// Sent instead of a verification code when registration is attempted for an
+	// existing email, so the code-send API response is uniform regardless of
+	// whether the email is registered (defends against account enumeration).
+	SendAlreadyRegistered(ctx context.Context, to string) error
 }
 
 // --------------------------------------------------------------------------
@@ -63,6 +68,30 @@ func (m *SMTPMailer) SendCode(_ context.Context, to, code string) error {
 	return nil
 }
 
+// SendAlreadyRegistered notifies an address that it already has an account.
+func (m *SMTPMailer) SendAlreadyRegistered(_ context.Context, to string) error {
+	subject := "Account notice / 账号提醒"
+	body := "This email already has an account. Please sign in instead of registering.\r\n" +
+		"该邮箱已注册账号，请直接登录，无需重新注册。如非本人操作可忽略此邮件。\r\n"
+
+	msg := strings.Join([]string{
+		"From: " + m.cfg.From,
+		"To: " + to,
+		"Subject: " + subject,
+		"MIME-Version: 1.0",
+		"Content-Type: text/plain; charset=UTF-8",
+		"",
+		body,
+	}, "\r\n")
+
+	addr := fmt.Sprintf("%s:%d", m.cfg.Host, m.cfg.Port)
+	auth := smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
+	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, []byte(msg)); err != nil {
+		return fmt.Errorf("auth: smtp send (already-registered): %w", err)
+	}
+	return nil
+}
+
 // --------------------------------------------------------------------------
 // Development log implementation
 // --------------------------------------------------------------------------
@@ -89,3 +118,13 @@ func (m *LogMailer) SendCode(_ context.Context, to, code string) error {
 	}
 	return nil
 }
+
+// SendAlreadyRegistered logs an already-registered notice for local development.
+func (m *LogMailer) SendAlreadyRegistered(_ context.Context, to string) error {
+	if m.logger != nil {
+		m.logger.Printf("[dev-mailer] already-registered notice for %s", to)
+	} else {
+		log.Printf("[dev-mailer] already-registered notice for %s", to)
+	}
+	return nil
+}