fix(auth): preserve the existing Boop account on email login

[brianorwhatever]

Summary

Email login now returns users to their existing Boop account when the same email has identities in other apps sharing the Turnkey parent organization. Previously, Boop selected the first global Turnkey email match and created a new local account when that identity differed, making the original lists disappear from view.

Returning users use Boop's saved account link; new users receive a separate identity. Existing duplicate records require an explicit operator selection instead of an arbitrary choice. Pending OTP sessions and user upserts recheck that selection, and conflicting signup sessions cannot insert another user for the same exact email. An undefined DID no longer matches another unfinished signup.

Rollout

Deploy the backend, then use the internal auth:selectLoginAccount operation to select the verified original user for each affected email. The operation preserves every user, DID, list, and Turnkey identity. Affected users must sign out and request a fresh OTP; existing JWTs are not revoked. Until selection, duplicate emails receive an account-recovery error.

The recovery runbook includes the operator commands and verification steps. This PR does not change production data or merge the duplicate accounts.

Validation

• Added 11 regression tests using the real Convex handlers and Turnkey signing with a mocked network. The initial nine failed against main, including selection of a foreign identity and duplicate user creation.
• Full suite: 187 passed, 0 failed.
• Backend and frontend TypeScript checks, changed-file ESLint, and the Vite production build passed.
• No live OTPs or production writes were used for testing.

[railway-app]

🚅 Deployed to the boop-pr-235 environment in Friends

Service	Status	Web	Updated
boop	✅ Success (View Logs)	Web	Sep 9, 2026 at 5:50 am UTC