[BUG]: Orphaned User Documents on Failed Email Send

### Bug Description

When signup fails due to a SendVerificationEmail error, the user document is already persisted in MongoDB with isVerified: false. No rollback is performed, so the email address is permanently "taken" — the user can't log in (blocked by the !IsVerified check) and can't re-register ("User already exists")

### Steps to Reproduce

1 . Set invalid SMTP credentials.
2 . POST /api/auth/signup with a new email → returns HTTP 500.
3 . Repeat the same request → returns HTTP 400 "User already exists"

Actual Behavior
User is permanently locked out of that email address. Recovery requires manual deleteOne in MongoDB

Expected Behavior
If the email send fails, the user document should be rolled back so the user can re-register freely

### Logs and Screenshots

Terminal Log :

[GIN] 2026/09/13 - 14:08:37 | 204 | 984.3µs | ::1 | OPTIONS "/signup"
[GIN] 2026/09/13 - 14:08:41 | 500 | 3.9518977s | ::1 | POST "/signup"

### Environment Details

- Component: backend/controllers/auth.go — SignUp() — Lines 194–209
- Database: MongoDB
- Mail: SMTP (Gmail)
- Framework: Go / Gin

### Impact

High - Major feature is broken

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

Start in backend/controllers/auth.go at SignUp() around lines 194–209, then reproduce the failure with invalid SMTP credentials and inspect whether the MongoDB user document remains. Done means a failed SendVerificationEmail leaves no unusable user record, and repeating POST /api/auth/signup with the same email can proceed without "User already exists".

Do mô hình lập chỉ mục viết ra từ nội dung của issue.