fix(api): stop logging an error when an anonymous user logs in to an existing account

[cqnykamp]

The error

Production logs a P2002 stack trace, several times a day:

Error upgrading anonymous user PrismaClientKnownRequestError:
Invalid `prisma.users.update()` invocation:
Unique constraint failed on the constraint: `users_email_key`
  at async upgradeAnonymousUser (apps/api/dist/src/query/user.js:110:18)

upgradeAnonymousUser sets users.email, which is unique. So it fails whenever
the email someone authenticates with already belongs to an account — that is,
every time a returning user browses anonymously and then logs in. It is an
ordinary login, not a failure.

serializeUser already produced the right outcome (catch, fall back to
findOrCreateUser, log them in to their real account), but the catch swallowed
every other error the same way, so a genuine database failure was
indistinguishable from this in the logs.

The change

• upgradeAnonymousUser returns null for the two no-op cases — P2002 (email
  already taken) and P2025 (account is not anonymous, or does not exist) — and
  rethrows everything else. The caller's existing if (!u) fallback covers
  both.
• Both serializeUser branches drop the blanket try/catch + console.log.
  A real database failure now reaches asyncPassport → done(err) and fails
  the login instead of passing silently. This is the one behavior change worth
  watching after deploy.
• New auth/parseFromAnonymous takes over the thing the blanket catch was
  legitimately guarding: toUUID throws on a malformed fromAnonymous value,
  and a bad cookie must not fail a login. It also folds in the magic-link " "
  placeholder check that was inline.
• The Google branch now runs updateUser only when the upgrade actually
  happened. Previously it sat inside the same try, so a failure there
  discarded an otherwise successful upgrade and hid the error.

Not in scope

Anonymous work is still not merged into the existing account. A student who
takes an assignment anonymously and then logs in stays two rows in
assignmentScores, so they appear twice in the instructor's student list
(apps/api/src/query/assign.ts:908 lists every row, with no anonymity filter).
Merging is a product decision about gradebook data and deserves its own change.

Tests

The single happy-path test moves out of test/users.test.ts into
auth/anonymousUpgrade.test.ts and grows to pin all five outcomes: unused email
(same userId, so the session survives), email taken → null, email taken →
both accounts untouched, account not anonymous → null and email unchanged,
user missing → null. Plus 3 unit tests for parseFromAnonymous.

Full API suite: 32 files, 415 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T6R3jTUpCKjeAKV64cd6FC

[cqnykamp]

/deploy-dev

[github-actions]

✅ Deployed refs/pull/3041/merge to dev3 → https://dev3.doenet.org
(first page load wakes it if the lights are off).

dev3 is shared: the next push to main overwrites this. To restore main:
gh workflow run dev-deploy.yml --ref main -f deploy_ref=main