docs: full API documentation + data compat guard

- docs/API.md: complete API reference (auth/identities/tickets/bans/users/
  settings/notifications/polls/features/export/captcha/uploads/external/
  install/health) with auth, rate limits, roles, data migration notes
- auth.js register: also check user_identities for duplicate game_name
  (multi-identity compat for old data backfilled into new table)
- README: link API docs, multi-identity section

backend/routes/auth.js

@@ -77,6 +77,11 @@ router.post('/register', validateLengths({
       const dup = await getRow('SELECT id FROM users WHERE game_name = ? AND source = ?', [game_name, source || 'netease']);
       if (dup) return res.status(400).json({ error: '该游戏名在此来源下已注册' });
     }
+    // 多来源兼容: 该游戏名可能已被其他账号绑定为副身份
+    try {
+      const dupIdent = await getRow('SELECT id FROM user_identities WHERE source = ? AND game_name = ?', [source || 'netease', game_name]);
+      if (dupIdent) return res.status(400).json({ error: '该游戏名已绑定其他账号' });
+    } catch {}
 
     const hashed = await bcrypt.hash(password, 10);
     const r = await query(