fix(user): harden account email and password handling

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

i18n/locales/zh-CN.yaml

@@ -75,6 +75,9 @@ user.session_save_failed: "无法保存会话信息，请重试"
 user.require_2fa: "请输入两步验证码"
 user.email_verification_required: "管理员开启了邮箱验证，请输入邮箱地址和验证码"
 user.verification_code_error: "验证码错误或已过期"
+user.email_already_taken: "邮箱地址已被占用"
+user.password_unset: "当前账号未设置密码，请使用密码重置或联系管理员重置密码"
+user.password_reset_link_invalid: "重置链接非法或已过期"
 user.input_invalid: "输入不合法 {{.Error}}"
 user.no_permission_same_level: "无权获取同级或更高等级用户的信息"
 user.no_permission_higher_level: "无权更新同权限等级或更高权限等级的用户信息"