Allow dot in usernames per NIP-05 local-part spec

Extend usernameRE to [a-z0-9_.-], preserve dots in SanitizeForUsername,
and add tests for validation, sanitization, and nip05 sync precedence.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/user/model.go

@@ -42,8 +42,9 @@ var (
 	ErrUsernameTaken   = errors.New("username taken")
 )
 
-// Username rules: 1-30 chars, [a-z0-9_-], lowercase, must start with alnum.
-var usernameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]{0,29}$`)
+// Username rules: 1-30 chars, [a-z0-9_.-], lowercase, must start with alnum.
+// Dot is allowed per NIP-05 local-part spec.
+var usernameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9_.-]{0,29}$`)
 
 func ValidateUsername(name string, reserved []string) error {
 	name = strings.ToLower(strings.TrimSpace(name))