feat(auth): make email the unique login identifier

Login is now by email, not username. username still exists internally
(JWT sub claim, audit logs, Jira actor attribution, SSO provisioning all
still key off it) but is now always kept equal to email everywhere a user
is created or their email changes — never a separately-chosen value.

- User.email is now unique + NOT NULL (migration b067 backfills any
  missing/blank email from username first, so existing rows — notably
  the seeded admin, which historically had none — never violate it).
- /auth/login and the (unused but updated for consistency)
  authenticate_user() now query by email.
- create_user (legacy, unreferenced but kept) and
  create_user_without_password both derive username from email.
- update_user keeps username in sync when email changes, and rejects
  duplicate emails.
- seed.py reads ADMIN_EMAIL (new env var, wired through install.sh and
  docker-compose.prod.yml) for the initial admin; falls back to an
  email-shaped ADMIN_USERNAME or a placeholder that's flagged for the
  operator to fix.
- admin_config.py's import bundle now matches/creates users by email,
  skipping (not crashing on) entries with no email.
- sso_service.py always sets username = email for SSO-provisioned users.
- LoginPage/auth.ts updated to email input/copy (wire field name stays
  'username' — that's the OAuth2PasswordRequestForm spec, not the value).

backend/app/routers/admin_config.py

@@ -222,6 +222,7 @@ async def import_config(
         "custom_templates": 0,
         "users_created": 0,
         "users_updated": 0,
+        "users_skipped_no_email": 0,
     }
 
     # ── 1. system_configs ────────────────────────────────────────────
@@ -309,12 +310,16 @@ async def import_config(
         summary["custom_templates"] += 1
 
     # ── 6. Users ─────────────────────────────────────────────────────
+    # Email is the unique login identifier — a bundle entry with no email
+    # (e.g. exported from an older instance, before this requirement) can't
+    # be created; it's skipped rather than crashing the whole import.
     import secrets as _secrets
     for item in bundle.get("users", []):
-        username = item.get("username")
-        if not username:
+        email = item.get("email")
+        if not email:
+            summary["users_skipped_no_email"] += 1
             continue
-        existing = db.query(User).filter(User.username == username).first()
+        existing = db.query(User).filter(User.email == email).first()
         if existing:
             existing.role = item.get("role", existing.role)
             existing.is_active = item.get("is_active", existing.is_active)
@@ -323,14 +328,13 @@ async def import_config(
             # Create with random temp password — user must reset on login
             temp_pw = _secrets.token_urlsafe(16) + "Aa1!"
             new_user = User(
-                username=username,
+                username=email,
+                email=email,
                 hashed_password=hash_password(temp_pw),
                 role=item.get("role", "viewer"),
                 is_active=item.get("is_active", True),
                 must_change_password=True,
             )
-            if item.get("email") and hasattr(User, "email"):
-                new_user.email = item["email"]
             db.add(new_user)
             summary["users_created"] += 1
 

backend/app/routers/auth.py

@@ -114,8 +114,10 @@ def login(
     Rate-limited to **5 attempts per minute per IP**.  Failed and successful
     logins are recorded in the audit log (SEC-009).
     """
-    # Assign user = db.query(User).filter(User.username == form_data.username).first()
-    user = db.query(User).filter(User.username == form_data.username).first()
+    # OAuth2PasswordRequestForm's field is spec-named "username" but the
+    # value a user actually types in is their email — email is the unique
+    # login identifier (username is an internal id, always kept == email).
+    user = db.query(User).filter(User.email == form_data.username).first()
     # Assign target_hash = user.hashed_password if user else _DUMMY_HASH
     target_hash = user.hashed_password if user else _DUMMY_HASH
     # Assign password_valid = verify_password(form_data.password, target_hash)
@@ -140,7 +142,7 @@ def login(
                 # Keyword argument: details
                 details={
                     # Literal argument value
-                    "username": form_data.username,
+                    "email": form_data.username,
                     # Literal argument value
                     "ip": ip,
                     # Literal argument value
@@ -152,7 +154,7 @@ def login(
             # Call uow.commit()
             uow.commit()
         # Raise BusinessRuleViolation
-        raise BusinessRuleViolation("Incorrect username or password")
+        raise BusinessRuleViolation("Incorrect email or password")
 
     # Check: not user.is_active
     if not user.is_active:
@@ -174,7 +176,7 @@ def login(
             "auth",
             str(user.id),
             # Keyword argument: details
-            details={"username": user.username, "ip": ip},
+            details={"email": user.email, "ip": ip},
             # Keyword argument: ip_address
             ip_address=ip,
         )