fix(user): harden account email and password handling

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

i18n/locales/en.yaml

@@ -74,6 +74,9 @@ user.session_save_failed: "Failed to save session, please try again"
 user.require_2fa: "Please enter two-factor authentication code"
 user.email_verification_required: "Email verification is enabled, please enter email address and verification code"
 user.verification_code_error: "Verification code is incorrect or has expired"
+user.email_already_taken: "Email address is already in use"
+user.password_unset: "This account has no password set. Please use password reset or contact an administrator to reset it."
+user.password_reset_link_invalid: "Password reset link is invalid or has expired"
 user.input_invalid: "Invalid input {{.Error}}"
 user.no_permission_same_level: "No permission to access users of same or higher level"
 user.no_permission_higher_level: "No permission to update users of same or higher permission level"

i18n/locales/zh-CN.yaml

@@ -75,6 +75,9 @@ user.session_save_failed: "无法保存会话信息，请重试"
 user.require_2fa: "请输入两步验证码"
 user.email_verification_required: "管理员开启了邮箱验证，请输入邮箱地址和验证码"
 user.verification_code_error: "验证码错误或已过期"
+user.email_already_taken: "邮箱地址已被占用"
+user.password_unset: "当前账号未设置密码，请使用密码重置或联系管理员重置密码"
+user.password_reset_link_invalid: "重置链接非法或已过期"
 user.input_invalid: "输入不合法 {{.Error}}"
 user.no_permission_same_level: "无权获取同级或更高等级用户的信息"
 user.no_permission_higher_level: "无权更新同权限等级或更高权限等级的用户信息"

i18n/locales/zh-TW.yaml

@@ -75,6 +75,9 @@ user.session_save_failed: "無法保存對話，請重試"
 user.require_2fa: "請輸入雙重驗證碼"
 user.email_verification_required: "管理員開啟了信箱驗證，請輸入信箱位址和驗證碼"
 user.verification_code_error: "驗證碼錯誤或已過期"
+user.email_already_taken: "信箱位址已被占用"
+user.password_unset: "目前帳號未設定密碼，請使用密碼重置或聯繫管理員重置密碼"
+user.password_reset_link_invalid: "重置連結非法或已過期"
 user.input_invalid: "輸入不合法 {{.Error}}"
 user.no_permission_same_level: "無權獲取同級或更高等級使用者的資訊"
 user.no_permission_higher_level: "無權更新同權限等級或更高權限等級的使用者資訊"