feat(auth): make email the unique login identifier

Login is now by email, not username. username still exists internally
(JWT sub claim, audit logs, Jira actor attribution, SSO provisioning all
still key off it) but is now always kept equal to email everywhere a user
is created or their email changes — never a separately-chosen value.

- User.email is now unique + NOT NULL (migration b067 backfills any
  missing/blank email from username first, so existing rows — notably
  the seeded admin, which historically had none — never violate it).
- /auth/login and the (unused but updated for consistency)
  authenticate_user() now query by email.
- create_user (legacy, unreferenced but kept) and
  create_user_without_password both derive username from email.
- update_user keeps username in sync when email changes, and rejects
  duplicate emails.
- seed.py reads ADMIN_EMAIL (new env var, wired through install.sh and
  docker-compose.prod.yml) for the initial admin; falls back to an
  email-shaped ADMIN_USERNAME or a placeholder that's flagged for the
  operator to fix.
- admin_config.py's import bundle now matches/creates users by email,
  skipping (not crashing on) entries with no email.
- sso_service.py always sets username = email for SSO-provisioned users.
- LoginPage/auth.ts updated to email input/copy (wire field name stays
  'username' — that's the OAuth2PasswordRequestForm spec, not the value).

backend/app/seed.py

@@ -1,7 +1,10 @@
 """Seed script — creates the initial admin user if it does not already exist.
 
 On first run the admin credentials are generated securely:
-- Username is read from ``ADMIN_USERNAME`` env var (default: ``admin``).
+- Email (the unique login identifier) is read from ``ADMIN_EMAIL`` env var.
+  Falls back to ``ADMIN_USERNAME`` if it's already email-shaped, otherwise
+  to a placeholder that MUST be changed before this account can receive
+  any webhook email (password reset, notifications, etc).
 - Password is read from ``ADMIN_PASSWORD`` env var.  When the variable is
   **not set**, a cryptographically random 16-character password is generated
   automatically and printed to the startup logs so the operator can copy it.
@@ -54,12 +57,19 @@ def seed_admin() -> None:
         # Assign admin_username = os.environ.get("ADMIN_USERNAME", "admin").strip() or "admin"
         admin_username = os.environ.get("ADMIN_USERNAME", "admin").strip() or "admin"
 
-        # Assign existing = db.query(User).filter(User.username == admin_username).first()
-        existing = db.query(User).filter(User.username == admin_username).first()
+        # Email is the unique login identifier — prefer ADMIN_EMAIL, then an
+        # already email-shaped ADMIN_USERNAME, then a placeholder that needs
+        # fixing later (Users page) before this account can receive email.
+        admin_email = os.environ.get("ADMIN_EMAIL", "").strip()
+        if not admin_email:
+            admin_email = admin_username if "@" in admin_username else f"{admin_username}@localhost"
+
+        # Assign existing = db.query(User).filter(User.email == admin_email).first()
+        existing = db.query(User).filter(User.email == admin_email).first()
         # Check: existing
         if existing:
             # Call print()
-            print(f"Admin user '{admin_username}' already exists — skipping.")
+            print(f"Admin user '{admin_email}' already exists — skipping.")
             # Return control to caller
             return
 
@@ -78,7 +88,9 @@ def seed_admin() -> None:
         # Assign admin = User(
         admin = User(
             # Keyword argument: username
-            username=admin_username,
+            username=admin_email,
+            # Keyword argument: email
+            email=admin_email,
             # Keyword argument: hashed_password
             hashed_password=hash_password(admin_password),
             # Keyword argument: role
@@ -98,7 +110,10 @@ def seed_admin() -> None:
         # Call print()
         print("=" * 60)
         # Call print()
-        print(f"  Username : {admin_username}")
+        print(f"  Login (email) : {admin_email}")
+        if "@localhost" in admin_email:
+            print("  ** No ADMIN_EMAIL was set — using a placeholder. **")
+            print("  ** Update it in Users before relying on emailed links. **")
         # Check: password_was_generated
         if password_was_generated:
             # Call print()