fix: allow profile sync for admin-created users

Stop pinning usernames on admin Add (manual_username=false) so sync matches
invoice-created users. Add migration to reset manual_username for existing
rows so they re-enter ListForSync; explicit renames still pin via SetUsername.

internal/db/migrations/0003_reset_manual_username.sql

@@ -0,0 +1,7 @@
+-- Reset manual_username for all users so the profile sync worker can
+-- re-evaluate every active user. Earlier admin Add calls always pinned the
+-- username at creation, which permanently excluded those rows from
+-- ListForSync. Going forward, only explicit username changes (admin Update
+-- via SetUsername) pin the row; sync will be a no-op when the kind:0
+-- profile already matches the stored handle.
+UPDATE users SET manual_username = 0 WHERE manual_username = 1;

internal/http/handlers/admin_users.go

@@ -66,7 +66,7 @@ func (h *AdminUsers) Add(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, true)
+	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, false)
 	if err != nil {
 		if errors.Is(err, user.ErrInvalidUsername) {
 			WriteError(w, http.StatusBadRequest, "ValidationError", "invalid username")