A signup link opened a file download in Safari. After the link flow was changed to open a normal page, the same signup failed with a "link expired" message instead.
That was the clue: changing how the failure appeared hadn't fixed what was failing.
Billing had moved from individual users to teams, but signup still expected the old account setup. Existing users could sign in. New users couldn't finish creating an account.
Updating signup to match the team setup fixed the failure. Changing the browser flow had only changed how the error appeared.
Email links still open a normal page at /verify. That was a useful change to the browser flow, but it wasn't the fix for signup.
If I ran into this again, I'd check the server error before rebuilding the link flow. "Link expired" was the message on the screen. It wasn't what had happened.