feat(members): split username/display_name, sync updates to authentik, add password reset API and refresh docs

scripts/init_schema.sql

@@ -21,6 +21,7 @@ CREATE TABLE users (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   authentik_sub TEXT NOT NULL UNIQUE,
   authentik_user_id INTEGER,
+  username TEXT UNIQUE,
   email TEXT UNIQUE,
   display_name TEXT,
   status VARCHAR(16) NOT NULL DEFAULT 'active',
@@ -144,6 +145,7 @@ VALUES ('member', 'Member Center', 'active')
 ON CONFLICT (system_key) DO NOTHING;
 
 CREATE INDEX idx_users_authentik_sub ON users(authentik_sub);
+CREATE INDEX idx_users_username ON users(username);
 CREATE INDEX idx_sites_company_id ON sites(company_id);
 CREATE INDEX idx_usp_user_id ON user_scope_permissions(user_id);
 CREATE INDEX idx_usp_module_id ON user_scope_permissions(module_id);

scripts/migrate_add_users_username.sql

@@ -0,0 +1,16 @@
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS username TEXT;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conname = 'uq_users_username'
+  ) THEN
+    ALTER TABLE users
+      ADD CONSTRAINT uq_users_username UNIQUE (username);
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);