A Second Check Is a Second Source of Truth

Signup verified the same email address twice — once by code, once by link. A real user passed the first and ignored the second, and landed in a state nobody designed: account created, fully usable, permanently flagged unverified. Redundant verificati