Continue with Google on /signup can actually register
The button reached Google correctly and the callback bounced every new visitor back to /login, so the door carrying Google's attestation of mailbox control was the one refusing to create an account while the door carrying no proof at all created freely.
The rule it hit — sign-in never creates a user — was right when a paid fulfilment was the only way to acquire an account, because then match-never-create genuinely meant no stranger could manufacture one. Self-serve sign-up has since opened creation to anybody with an address and eight characters, with no proof they read mail there. The two doors were calibrated backwards.
Permission to create travels in the sealed flow token, set from an intent parameter on a request that came from our own /signup page, and it is never read from the callback’s query string. Google echoes back only the code and the state, so an intent read there would be attacker-controlled and would turn any sign-in link into an account factory. There is a test for exactly that request.
The other two refusals are untouched — an identity pointing at a deleted account, and a Google subject that already signs in as somebody else — and neither may create anything whatever the flow says. Account creation also moved into one place, because an account is three rows and two independent copies of that is the shape where the second one quietly grows a missing row.