store: lowercase username, email/disable helpers, last-admin count

internal/store/users_test.go

@@ -131,6 +131,40 @@ func TestSessionLifecycle(t *testing.T) {
 	}
 }
 
+func TestCreateUserLowercasesUsername(t *testing.T) {
+	t.Parallel()
+	s := openTestStore(t)
+	ctx := context.Background()
+	now := time.Now().UTC()
+
+	if err := s.CreateUser(ctx, User{
+		ID: "u1", Username: "Alice",
+		PasswordHash: "x", Role: RoleAdmin, CreatedAt: now,
+	}); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	got, err := s.GetUserByUsername(ctx, "alice")
+	if err != nil {
+		t.Fatalf("get lower: %v", err)
+	}
+	if got.Username != "alice" {
+		t.Errorf("stored username: got %q want %q", got.Username, "alice")
+	}
+	got, err = s.GetUserByUsername(ctx, "ALICE")
+	if err != nil {
+		t.Fatalf("get upper: %v", err)
+	}
+	if got.ID != "u1" {
+		t.Errorf("upper-case lookup missed: got %+v", got)
+	}
+	if err := s.CreateUser(ctx, User{
+		ID: "u2", Username: "AlIcE",
+		PasswordHash: "x", Role: RoleAdmin, CreatedAt: now,
+	}); err == nil {
+		t.Error("duplicate (different case) should fail")
+	}
+}
+
 func TestEnrollmentTokenSingleUse(t *testing.T) {
 	t.Parallel()
 	s := openTestStore(t)