feat(auth): 防账号枚举 — 已注册邮箱发"已注册"提醒,不内联暴露

发码/注册都不再泄露"邮箱是否已注册"(对翻墙工具尤其敏感:已注册=该人是用户)。
- SendCode:邮箱已注册时不发验证码、改发"您已注册请直接登录"邮件,接口统一
  返回 204(注册/未注册无差别)→ 关掉发码侧枚举
- Register:命中已注册(ErrEmailTaken)改回通用 ErrCodeInvalid(与错码一致),
  不再返回"该邮箱已注册"→ 关掉注册侧枚举
- Mailer 接口加 SendAlreadyRegistered(SMTP + Log 两实现)
- 测试:DuplicateEmailConflict 改为断言"已注册不发码 + 强制码也只回通用错误";
  integration 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/service.go

@@ -121,6 +121,22 @@ func (s *Service) SendCode(ctx context.Context, rawEmail, ip string) (retryAfter
 		}
 	}
 
+	// Anti-enumeration: a registered email gets a "you already have an account"
+	// notice instead of a verification code; the API response (204) is identical
+	// either way, so this endpoint can't be used to discover which emails are
+	// registered. (Critical for a circumvention tool: a registered email implies
+	// the person uses the service.)
+	if _, err := s.store.GetUserByEmail(ctx, email); err == nil {
+		go func(to string) {
+			sendCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			_ = s.mailer.SendAlreadyRegistered(sendCtx, to)
+		}(email)
+		return 0, nil
+	} else if !errors.Is(err, ErrNotFound) {
+		return 0, ErrInternal
+	}
+
 	code, err := genNumericCode(6)
 	if err != nil {
 		return 0, ErrInternal
@@ -165,7 +181,12 @@ func (s *Service) Register(ctx context.Context, rawEmail, code, password string)
 	user, err := s.store.CreateUserWithTrial(ctx, email, pwHash, s.cfg.TrialDays)
 	if err != nil {
 		if errors.Is(err, ErrEmailTaken) {
-			return nil, ErrEmailExists
+			// Anti-enumeration: do NOT reveal the email is already registered.
+			// A registered email never receives a code (SendCode mails a login
+			// reminder instead), so this branch is normally unreachable; if hit
+			// (e.g. a race), return the same generic error as a wrong/expired
+			// code rather than "email exists".
+			return nil, ErrCodeInvalid
 		}
 		return nil, ErrInternal
 	}