fix: prevent username/email enumeration via registration error messages

backend/routes/auth.js

@@ -41,12 +41,9 @@ router.post('/register', validateLengths({
     }
 
     const existingUser = await getRow('SELECT id FROM users WHERE username = ?', [username]);
-    if (existingUser) {
-      return res.status(400).json({ error: '用户名已存在' });
-    }
     const existingEmail = await getRow('SELECT id FROM users WHERE email = ?', [email]);
-    if (existingEmail) {
-      return res.status(400).json({ error: '邮箱已被注册' });
+    if (existingUser || existingEmail) {
+      return res.status(400).json({ error: '用户名或邮箱已被使用' });
     }
 
     const hashed = await bcrypt.hash(password, 10);