Check Email Canonical

Check whether a Gmail address is a dot-trick duplicate of an existing account.

Only meaningful for @gmail.com / @googlemail.com addresses. Always returns duplicate: false for all other domains. This intentionally trades limited account-enumeration exposure for a clear signup error; the unauthenticated route is IP-rate-limited.