Signup, verify-account and OTP verification routed every failure through the global error modal, which blocked the whole screen for recoverable input errors such as an already-registered email or a wrong OTP code.
- add ErrorHandler.showError plus extractApiErrorMessage to pull a single readable message out of an API error response
- suppress the global error modal around the signup and verify-email calls so those screens can show their own toast
- invalidate previously issued email verify tokens on resend, so only the latest code can pass
- pass the real safe-area top inset to FlashMessage, whose own iPhone-X detection under-estimates it on Dynamic Island devices
- raise the login password minimum to 8 characters to match the API
- drop the unused back handler on the create account screen and even out the OTP and verify button heights