Upgrade Guest Account

Attach a verified Apple or Google identity to the caller's guest account.

This exists because POST /auth/social cannot do it. That endpoint takes no current user: it calls find_or_create_user(), which matches on the provider id, then on a verified email, and otherwise creates a new row. A guest who signs in there keeps nothing — their saved places and plans stay on the account they just walked away from, orphaned at the exact moment they decided to commit.

Here the row is mutated in place, so the id never changes and every place, plan, collection and visit stays attached. The caller's existing tokens remain valid for the same reason.

A provider identity already in use is refused, never merged. Merging two populated accounts means choosing which home location, which collections and which history survive, and getting that wrong destroys data silently. The friction of "sign in instead" is recoverable; a bad merge is not.