Make subscription_type, username, and years optional on POST /v1/admin/users

- subscription_type defaults to lifetime when omitted; validated when provided
- years is only required (and enforced) when subscription_type is yearly
- username uniqueness check and validation are skipped when username is empty
- Update OpenAPI spec to reflect pubkey as the only required field

internal/user/service.go

@@ -39,8 +39,10 @@ func (s *Service) IsAvailable(ctx context.Context, username string) (bool, error
 // concerns (e.g. payments worker uses this within a tx).
 func (s *Service) CreateOrActivate(ctx context.Context, pubkey, username string, sub SubscriptionType, years int, manual bool) (*User, error) {
 	username = NormalizeUsername(username)
-	if err := ValidateUsername(username, s.reserved); err != nil {
-		return nil, err
+	if username != "" {
+		if err := ValidateUsername(username, s.reserved); err != nil {
+			return nil, err
+		}
 	}
 	now := time.Now().UTC()
 	expiresAt := computeExpiry(sub, years, time.Time{}, now)