feat(members): split username/display_name, sync updates to authentik, add password reset API and refresh docs

backend/scripts/init_schema.sql

@@ -21,6 +21,7 @@ CREATE TABLE users (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   authentik_sub TEXT NOT NULL UNIQUE,
   authentik_user_id INTEGER,
+  username TEXT UNIQUE,
   email TEXT UNIQUE,
   display_name TEXT,
   status VARCHAR(16) NOT NULL DEFAULT 'active',
@@ -144,6 +145,7 @@ VALUES ('member', 'Member Center', 'active')
 ON CONFLICT (system_key) DO NOTHING;
 
 CREATE INDEX idx_users_authentik_sub ON users(authentik_sub);
+CREATE INDEX idx_users_username ON users(username);
 CREATE INDEX idx_sites_company_id ON sites(company_id);
 CREATE INDEX idx_usp_user_id ON user_scope_permissions(user_id);
 CREATE INDEX idx_usp_module_id ON user_scope_permissions(module_id);