Replace string-matching error detection with typed SQLite errors

Use errors.As with *sqlite.Error and SQLITE_CONSTRAINT_UNIQUE code
instead of fragile strings.Contains(err.Error(), "UNIQUE") checks.

Add db.IsUniqueConstraintError helper in internal/db/errors.go and
replace all three string-matching call sites in api.go and auth.go.

internal/db/errors.go

@@ -0,0 +1,20 @@
+// Package db provides database access and migration management.
+package db
+
+import (
+	"errors"
+
+	"modernc.org/sqlite"
+	sqlite3 "modernc.org/sqlite/lib"
+)
+
+// IsUniqueConstraintError reports whether err is a SQLite
+// unique-constraint violation.
+func IsUniqueConstraintError(err error) bool {
+	var sqliteErr *sqlite.Error
+	if !errors.As(err, &sqliteErr) {
+		return false
+	}
+
+	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
+}