The account used to be registered on the last screen of signup, so email, phone and password sat in a client store across three screens and were lost if the user dropped out. /auth/signup now runs as soon as the email code verifies, and the profile screens save through PUT /users/profile instead.
- signup data is cleared once the account exists, so it cannot be registered twice
- create-account and verify-account now work off the session and the profile
- index redirects to create-account when name, birthday or address is missing, so an account cannot reach home with an unusable profile
- sign-in clears the react-query cache: queries are keyed by endpoint, not by user, so a new account was being served the previous one's profile
- drops the signup access-token path in verification, now that signup has a session
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com