fix(user): harden account email and password handling

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

model/errors.go

@@ -11,6 +11,9 @@ var (
 var (
 	ErrInvalidCredentials   = errors.New("invalid credentials")
 	ErrUserEmptyCredentials = errors.New("empty credentials")
+	ErrEmailAlreadyTaken    = errors.New("email already taken")
+	ErrEmailNotFound        = errors.New("email not found")
+	ErrEmailAmbiguous       = errors.New("email matches multiple users")
 )
 
 // Token auth errors