auth

Sign-up and credential/email checks.

📄️Check whether an email is registered

Reports whether an email is already registered, so the signup form can warn before submitting. Unauthenticated by design; it therefore leaks account existence, which is an accepted trade-off for signup UX, but it is IP rate-limited so it can't be used to bulk-enumerate accounts, and it only ever returns a boolean.

📄️Peek login rate-limit status

Read-only login rate-limit status. The login form calls this after a failed `signIn` to classify the failure, because NextAuth (Auth.js v5) reports any `authorize` error only as a generic `CredentialsSignin`, so the client cannot otherwise tell a captcha challenge or a temporary block apart from bad credentials. This does NOT count an attempt (the credentials `authorize` path is the single source of truth); it only reports the flags that path already set. Public.

📄️Register a new account

Self-service account registration. New accounts are created with no elevated privileges; access is granted later through the staff-only user-management routes. Gated by the `allowSignup` system setting, and protected by a tiered rate limiter: repeated attempts escalate from silent friction, to a captcha challenge (428), to an outright block (429). The password must satisfy the strength policy.