signup: close two concurrency holes from final review

(1) RegisterAnonymousViewer now catches the unique-violation
    race (SQLSTATE 23505 on Postgres / code 19 on SQLite) and
    re-reads by UDID, returning the existing row instead of
    surfacing 500 to the second concurrent /tool/signup caller.
    New repo test exercises the back-to-back register path.

(2) Add unique index on SocialAccountConnection (AccountType,
    AccountId). The auth handler's find-or-link path claimed
    this index existed as the dedup backstop; the claim was
    accurate as design intent but the schema was missing. Now
    matched. Comment in handler updated.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

SVSim.UnitTests/Repositories/ViewerRepositoryTests.cs

@@ -99,6 +99,37 @@ public class ViewerRepositoryTests
             "Default-loadout body should populate Classes (smoke-test the shared BuildDefaultViewer helper).");
     }
 
+    [Test]
+    public async Task RegisterAnonymousViewer_concurrent_same_udid_returns_existing_not_duplicate()
+    {
+        using var factory = new SVSimTestFactory();
+        var udid = Guid.NewGuid();
+
+        long firstId;
+        using (var scope = factory.Services.CreateScope())
+        {
+            var repo = scope.ServiceProvider.GetRequiredService<IViewerRepository>();
+            firstId = (await repo.RegisterAnonymousViewer(udid)).Id;
+        }
+
+        // Second register with the same UDID — simulates the race losing thread after the unique
+        // index has caught the duplicate. We expect a clean re-fetch, NOT an exception or duplicate.
+        long secondId;
+        using (var scope = factory.Services.CreateScope())
+        {
+            var repo = scope.ServiceProvider.GetRequiredService<IViewerRepository>();
+            secondId = (await repo.RegisterAnonymousViewer(udid)).Id;
+        }
+
+        Assert.That(secondId, Is.EqualTo(firstId),
+            "Second register must return the existing row, not create a duplicate.");
+
+        using var verifyScope = factory.Services.CreateScope();
+        var db = verifyScope.ServiceProvider.GetRequiredService<SVSimDbContext>();
+        var count = await db.Viewers.CountAsync(v => v.Udid == udid);
+        Assert.That(count, Is.EqualTo(1));
+    }
+
     [Test]
     public async Task RegisterAnonymousViewer_with_empty_udid_throws()
     {