feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

Makes `users.email` unique, de-duplicates the addresses an upgrade will find,
and builds the self-service change-and-verify flow that did not exist.

The uniqueness index is on a generated `email_norm AS (LOWER(email)) STORED`
column under `utf8mb4_bin`, NOT on `email` under a `_ci` collation as the plan
specified. Every case-insensitive collation this server offers is also
accent-insensitive: `josé@x.com` and `jose@x.com` compare equal, and those are
two different mailboxes. The plan's index would have refused the second address
forever and the de-duplication would have nulled a legitimate account's.

A requested address is STAGED in `email_pending` and only a tokened link
installs it, so a typo cannot silently redirect account-recovery mail.

`isDuplicateUsername()` now distinguishes the two indexes. All five call sites
branch on it; each answers differently on purpose, because a public form, an
IdP callback, a half-completed invite and an admin screen do not owe the same
person the same amount of truth.

SSO reads the IdP's actual `email_verified`/`verified` claim instead of
inferring verification from an address merely being present.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/model/users/users.db.js

@@ -1,7 +1,7 @@
 const { query } = require('../../utils/db')
 
 const PUBLIC_COLS =
-  'id, username, role, status, email, email_verified, totp_enabled, created_at, last_login_at'
+  'id, username, role, status, email, email_verified, email_pending, totp_enabled, created_at, last_login_at'
 
 // passwordHash may be null (SSO-provisioned players who have not set one yet).
 // email/status/emailVerified are optional so existing admin-create callers are
@@ -31,17 +31,47 @@ async function findById(id) {
   return rows[0] || null
 }
 
-// All ACTIVE accounts on an email address. Email is intentionally non-unique
-// (SSO emails may repeat), so a reset request can legitimately match several
+// The ACTIVE account on an email address, as a list. Unique since engagement
+// Phase 1b, so this returns at most one row — the array shape is kept because the
+// password-reset caller iterates and there is nothing to gain from making it care.
 // accounts; the caller issues one reset link per row. Case-insensitive to match
 // however the address was stored. Excludes disabled/banned accounts.
+// Active accounts on an address. Matches on email_norm, the same generated column
+// the UNIQUE index uses, so a lookup folds case exactly the way uniqueness does —
+// LOWER() here and LOWER() there can never drift apart. Since Phase 1b this
+// returns at most one row; it still returns an array because the password-reset
+// caller iterates and there is no value in making that caller care.
 async function findActiveByEmail(email) {
   return query(
-    "SELECT * FROM users WHERE email = ? AND status = 'active'",
+    "SELECT * FROM users WHERE email_norm = LOWER(?) AND status = 'active'",
     [email],
   )
 }
 
+// Stage an address the user has asked for but not yet proved. Does not touch
+// `email`, so their current address keeps receiving mail until the link is used.
+async function setPendingEmail(id, email) {
+  const res = await query('UPDATE users SET email_pending = ? WHERE id = ?', [email, id])
+  return res.affectedRows || 0
+}
+
+// Promote a proved address into place. Guarded on email_pending still matching, so
+// a stale link (the user asked again for a different address) cannot install the
+// address it was minted for. Returns rows changed — 0 means the guard rejected it.
+async function promotePendingEmail(id, email) {
+  const res = await query(
+    `UPDATE users SET email = ?, email_verified = 1, email_pending = NULL
+      WHERE id = ? AND email_pending = ?`,
+    [email, id, email],
+  )
+  return res.affectedRows || 0
+}
+
+async function clearPendingEmail(id) {
+  const res = await query('UPDATE users SET email_pending = NULL WHERE id = ?', [id])
+  return res.affectedRows || 0
+}
+
 async function listUsers() {
   return query(`SELECT ${PUBLIC_COLS} FROM users ORDER BY id ASC`)
 }
@@ -112,6 +142,9 @@ module.exports = {
   findByUsername,
   findById,
   findActiveByEmail,
+  setPendingEmail,
+  promotePendingEmail,
+  clearPendingEmail,
   listUsers,
   updateUser,
   deleteUser,