feat(auth): 防账号枚举 — 已注册邮箱发"已注册"提醒,不内联暴露

发码/注册都不再泄露"邮箱是否已注册"(对翻墙工具尤其敏感:已注册=该人是用户)。
- SendCode:邮箱已注册时不发验证码、改发"您已注册请直接登录"邮件,接口统一
  返回 204(注册/未注册无差别)→ 关掉发码侧枚举
- Register:命中已注册(ErrEmailTaken)改回通用 ErrCodeInvalid(与错码一致),
  不再返回"该邮箱已注册"→ 关掉注册侧枚举
- Mailer 接口加 SendAlreadyRegistered(SMTP + Log 两实现)
- 测试:DuplicateEmailConflict 改为断言"已注册不发码 + 强制码也只回通用错误";
  integration 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/service_test.go

@@ -88,11 +88,24 @@ func TestService_DuplicateEmailConflict(t *testing.T) {
 		t.Fatalf("first register: %v", e)
 	}
 
-	// Second: new code, but the email is already taken → 409.
-	_, _ = svc.SendCode(ctx, email, "")
-	_, apiErr := svc.Register(ctx, email, codeInRedis(t, svc, email), "password2")
-	if apiErr == nil || apiErr.Code != ErrEmailExists.Code {
-		t.Fatalf("want email_exists, got %v", apiErr)
+	// Anti-enumeration: SendCode for a now-registered email must NOT store a
+	// verification code (it mails a login reminder instead), so the API response
+	// can't be used to discover that the email is registered.
+	if _, e := svc.SendCode(ctx, email, ""); e != nil {
+		t.Fatalf("second SendCode: %v", e)
+	}
+	if c := svc.rdb.Get(ctx, codeKey(email)).Val(); c != "" {
+		t.Fatalf("registered email must not receive a code, got %q", c)
+	}
+
+	// Even if a code is forced (e.g. a race), Register returns the generic code
+	// error rather than "email exists" — no enumeration leak.
+	if err := svc.rdb.Set(ctx, codeKey(email), "654321", 10*time.Minute).Err(); err != nil {
+		t.Fatalf("force code: %v", err)
+	}
+	_, apiErr := svc.Register(ctx, email, "654321", "password2")
+	if apiErr == nil || apiErr.Code != ErrCodeInvalid.Code {
+		t.Fatalf("want code_invalid (anti-enumeration), got %v", apiErr)
 	}
 }