#3426 feat(api): add POST /auth/register for website signup

Summary (AI generated)

• Add POST /auth/register on the Hono/Cloudflare API and Supabase auth edge function
• Mirror GoTrue self-signup: Turnstile, is_not_deleted, user metadata, public.users seeding, bcrypt via signUp
• Return { user, session } tokens for console handoff per website contract
• Add integration and unit tests for success and error codes

Contract: leave-supabase-phase1-register-api.md (handoff from Cap-go/website#1040)

Motivation (AI generated)

The marketing site register page now POSTs to https://api.capgo.app/auth/register instead of calling Supabase Auth directly. Production currently returns 404, blocking Cap-go/website#1040.

Business Impact (AI generated)

Unblocks the website signup cutover away from PostgREST/GoTrue client calls. New users can register on capgo.app and land in the console with a valid session.

Test Plan (AI generated)

• bunx vitest run tests/auth-register.unit.test.ts
• CI: tests/auth-register.test.ts (success, invalid_request, account_deleted, email_exists)
• After deploy: open https://capgo.app/register/, submit a new email, confirm redirect to console with tokens and /app
• Confirm deleted-account and duplicate-email toasts match contract error codes

Verification (AI generated)

Local integration (requires Supabase):

bun run supabase:with-env -- bunx vitest run tests/auth-register.test.ts

Manual after deploy:

curl -sS -X POST https://api.capgo.app/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"email":"you+test@example.com","password":"Password123!","first_name":"Jane","last_name":"Doe"}'

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features
  • Added a public account registration endpoint that validates registration details, enforces password and captcha requirements, and returns session credentials when sign-up succeeds.
  • Registration rejects malformed requests, duplicate emails, deleted accounts, and rate-limited attempts with appropriate errors. Successful registrations save profile details and optional device, operating system, and browser information.
• Tests
  • Added coverage for successful registration, validation failures, captcha handling, deleted accounts, duplicate registrations, and rate limits.