Update privacy policy, code review

server/server_account.go

@@ -29,8 +29,8 @@ func (s *Server) handleAccountCreate(w http.ResponseWriter, r *http.Request, v *
 		} else if u != nil {
 			return errHTTPUnauthorized // Cannot create account from user context
 		}
-		if !v.AccountCreationAllowed() {
-			return errHTTPTooManyRequestsLimitAccountCreation
+		if !v.AccountActionAllowed() {
+			return errHTTPTooManyRequestsLimitAccountActions
 		}
 	}
 	newAccount, err := readJSONWithLimit[apiAccountCreateRequest](r.Body, jsonBodyBytesLimit, false)
@@ -50,7 +50,7 @@ func (s *Server) handleAccountCreate(w http.ResponseWriter, r *http.Request, v *
 		}
 		return err
 	}
-	v.AccountCreated()
+	v.AccountActionPerformed()
 	// If an email was provided and email sending is configured, start verification (best-effort).
 	// The address becomes the primary email on verify (the new account has no primary yet); a
 	// failure to send must not fail signup, so we only log it.
@@ -801,10 +801,10 @@ func (s *Server) handleAccountPasswordResetRequest(w http.ResponseWriter, r *htt
 		return err
 	}
 	// Rate limit via the shared per-visitor account-creation bucket (no new limiter/config)
-	if !v.AccountCreationAllowed() {
-		return errHTTPTooManyRequestsLimitAccountCreation
+	if !v.AccountActionAllowed() {
+		return errHTTPTooManyRequestsLimitAccountActions
 	}
-	v.AccountCreated() // Consume a token on every request (including no-match), to throttle probing
+	v.AccountActionPerformed() // Consume a token on every request (including no-match), to throttle probing
 	identifier := strings.TrimSpace(req.Identifier)
 	if identifier != "" && s.config.BaseURL != "" {
 		if userID, email, ok := s.resolveResetTarget(identifier); ok {