mrhid6andClaude Opus 5
4bb7400b8e
Adds GET /auth/me so the admin site's route guards can know who is signed in, POST /auth/signup for self-hosted customers, and max_relinks on the account payload so the UI never hardcodes a rule the backend enforces. Signup follows sitesvc's proven shape: honeypot answered as success, a generic 201 when the address already exists, and nothing usable until the emailed link is opened. Also fixes a lockout found while verifying it. When the verification email failed, the account was rolled back but the customer_users row survived -- an orphan that can never be signed in to and that holds the unique index on email, so every later signup with that address got a cheerful 201 and the customer was locked out of their own address with no visible error. CreateCustomerUser now undoes its own insert. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>