Register dup detection: use server timestamps (created_at vs confirmation_sent_at), not client clock #26

Follow-up to #4 / #25 review.

isExistingAccount (frontend/src/utils/registerHelpers.js after krish/fix-signup-review-followups, else Register.jsx) compares Date.now() to server created_at with a 5 min threshold. A client clock >5 min fast flags every new signup as "already exists" — the failure mode the threshold was chosen to avoid. authHelpers.js already bans client clocks for this reason.

Fix: unconfirmed re-signup refreshes confirmation_sent_at but keeps old created_at; new user has them ~equal. Compare the two server fields (e.g. gap > 60 s → existing); fall back to NEW when either missing/unparseable. Drop now param.

Also add test for error-string path (error.message 'User already registered' → duplicate msg + links) — currently untested.

Size: S.