Usernames are not unique

[jenul-ferdinand]

Problem

Usernames are not unique. Two accounts can share the same username.

• The schema declares username with no unique constraint or index: user.model.ts
• The username update saves the new value without checking whether it is already taken: user.service.ts
• The default username comes from the first 8 characters of the email in a pre-save hook, so two emails sharing an 8-character prefix collide by default: user.model.ts

Why it matters

• Usernames are public identifiers, looked up via getByUsername. Duplicates make lookups ambiguous.
• Ties into Add username update to the profile panel #289 (username update in the profile panel), the path where users will hit collisions.

What to do

• Add a unique index on username.
• Check for an existing username before saving in updateUser, and return a 409 when taken.
• Handle collisions in the default-username pre-save hook.
• Resolve existing duplicate usernames before enforcing the constraint.