[VULN-21] Account Enumeration via Signup Errors

[lyncmi07]

Severity: Low
Affected location: routes/auth.ts:23-26

Issue:
Signup returns explicit "username already taken" message, allowing enumeration of existing usernames.

Mitigation plan:

1. Return generic response for signup conflicts.
2. Keep detailed reason only in server logs.
3. Pair with rate limiting on signup attempts.

Verification / tests:

• Test duplicate vs non-duplicate signup responses are indistinguishable to client.