fix(user): unique index on LOWER(mail) [GATED — merge after duplicate cleanup]

[Blume1977]

⚠️ Do NOT merge until the duplicate-account cleanup is complete

Follow-up to #3855. This replaces the non-unique LOWER(mail) index with a UNIQUE partial index, permanently preventing duplicate accounts for the same e-mail.

CREATE UNIQUE INDEX fails on deploy if any case-insensitive duplicate mail still exists. This PR may only be merged once the pre-check returns zero rows:

SELECT LOWER(mail) AS mail_lc, array_agg(id ORDER BY id) AS ids, count(*) AS n
FROM user_data WHERE mail IS NOT NULL
GROUP BY LOWER(mail) HAVING count(*) > 1 ORDER BY n DESC;

Index predicate (deliberate)

CREATE UNIQUE INDEX "IDX_user_data_mail_lower" ON "user_data" (LOWER("mail"))
WHERE "mail" IS NOT NULL AND "status" IN ('Active','NA','KycOnly','Deactivated');

The predicate mirrors the dedup set used by getUsersByMail(onlyValidUser) and excludes Merged/Blocked rows:

• merged slaves keep their mail (mergeUserData does not null it),
• blocked duplicates may keep theirs for audit.

A bare WHERE mail IS NOT NULL would fail on every historical merge pair and would break future merges. Scoping to the active set keeps the uniqueness guarantee consistent with the lookup that enforces it.

Depends on

• fix(user): case-insensitive mail lookup to prevent duplicate accounts #3855 (case-insensitive lookup + data normalization + non-unique index)
• Operational duplicate-merge campaign (Ops/Compliance)

[github-actions]

⚠️ Unverified Commits (1)

The following commits are not signed/verified:

• f93c02a fix(user): unique index on LOWER(mail) to enforce e-mail uniqueness (Blume1977)

How to sign commits

# SSH signing (recommended)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Re-sign last commit
git commit --amend -S --no-edit
git push --force-with-lease