Failures the authentication flows raise in more than one place, defined
once so their text and status agree. A failure one route alone reports
stays inline in that route.
Users a tenant creates for someone else. Each is an invitation until the
person proves they own the address and accepts. Acceptance sets
emailVerified, which login requires and clients cannot set.