fix(auth): prevent anonymous identity hijacking on duplicate username

[AryanYadav215]

Description

Resolves the anonymous identity hijacking vulnerability. Previously, a malicious actor could take over an existing anonymous account if the original user had not yet attached an email address. This PR enforces strict uniqueness for all usernames upon creation.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Security fix (addresses a vulnerability)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

What changed?

• packages/server/src/routes/auth.ts: Updated the POST /anonymous route to immediately reject requests with a 409 Conflict if the requested username already exists in the database.
• Added authAuditLogs integration to log signup_failed events when a collision or takeover is attempted, capturing the IP and User-Agent.
• Fixed a minor TypeScript strictness issue (TS7005) by explicitly typing the user variable to prevent implicit any errors.

How has this been tested?

• Local environment verification
• Edge cases tested (Attempted to create an anonymous account with a newly minted username, then attempted to claim it again on a different session—successfully received a 409).
• No regression in existing test suites (standard login, upgrade, and token rotation flows remain unaffected).

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings

ECSOC'26

[vercel]

@AryanYadav215 is attempting to deploy a commit to the Dharm3112's projects Team on Vercel.

A member of the Team first needs to authorize it.

[netlify]

👷 Deploy request for intellicircle pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	4994631