You probably don’t wanna allow special characters in username. Look at how twitter, Facebook and other big sites do it. If you limit username strictly to alphanumeric then its just matter of checking @ in string to distinguish between email and username.

Yes. Dump the idea of “username” as a login token.

I personally hate being asked to “pick a username” when my email
is absolutely guaranteed to be unique in your system, and a value
I’ll remember easily.

What value does your bifurcated login path provide?

You can check by regex if passed params looks like an email, otherwise use it as name…