fix(user): harden account email and password handling

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

i18n/locales/zh-TW.yaml

@@ -75,6 +75,9 @@ user.session_save_failed: "無法保存對話，請重試"
 user.require_2fa: "請輸入雙重驗證碼"
 user.email_verification_required: "管理員開啟了信箱驗證，請輸入信箱位址和驗證碼"
 user.verification_code_error: "驗證碼錯誤或已過期"
+user.email_already_taken: "信箱位址已被占用"
+user.password_unset: "目前帳號未設定密碼，請使用密碼重置或聯繫管理員重置密碼"
+user.password_reset_link_invalid: "重置連結非法或已過期"
 user.input_invalid: "輸入不合法 {{.Error}}"
 user.no_permission_same_level: "無權獲取同級或更高等級使用者的資訊"
 user.no_permission_higher_level: "無權更新同權限等級或更高權限等級的使用者資訊"