Email uniqueness not checked before update, raw DB error returned to client

[windoze95]

Summary

In internal/service/user.go:149-153, UpdateUser validates email format but never checks if the new email is already in use by another user. The database has a unique constraint on the email column, so the update will fail with a raw PostgreSQL unique violation error that propagates as an opaque 500 response to the client.

This is inconsistent with username updates, where UsernameExists is explicitly checked before attempting the update.

Impact

• Users attempting to use an already-taken email receive a generic 500 error with no actionable message
• Raw DB error details may be exposed in the response body (see also: error message leakage)

Suggested Fix

Check email uniqueness before attempting the update:

if exists, err := s.Repo.EmailExists(email); err != nil {
    return fmt.Errorf("checking email: %w", err)
} else if exists {
    return ErrEmailTaken // define a sentinel error, return 409 in handler
}