Registration now carries explicit intent to the API. An existing normalized email returns account_exists before issuing a signup code. The app displays “Ce compte existe déjà” and offers sign-in or explicit password recovery, preserving the entered address and current local account.

The API rechecks at OTP verification to handle an account created after code delivery. It consumes the verified code without issuing credentials or changing the existing owner. Legacy code sign-in remains compatible. The app also handles an older API returning action: sign_in without presenting password reset as a new registration. Recovery requires requesting and verifying a code explicitly and retains the same owner and holdings.

This matches backend tcg-collector-backend#591 (045319d3, issue #590), which rejects duplicate explicit registration and is merged into backend staging. App poc-tcg-collector#863 (f8bdd8c0fe161b81460eb92601bc4f899e1fadd3) is merged into app staging. Neither side is deployed.

Validation remains the local evidence recorded with the change: API route tests, a local PGlite SQL account lifecycle proving duplicate requests issue no token and recovery preserves holdings, API-client tests, and rendered mobile signup/recovery tests. Maestro duplicate-signup coverage is opt-in for a disposable existing address and was not executed. No migration, live account mutation, email to a real user, emulator install or collection write was performed.

The explicit pre-verification signup conflict reveals whether an address exists; this is the requested product behavior. Existing per-IP throttling remains.