fix: allow profile sync for admin-created users

Stop pinning usernames on admin Add (manual_username=false) so sync matches
invoice-created users. Add migration to reset manual_username for existing
rows so they re-enter ListForSync; explicit renames still pin via SetUsername.

internal/db/migrations/0003_reset_manual_username.sql

@@ -0,0 +1,7 @@
+-- Reset manual_username for all users so the profile sync worker can
+-- re-evaluate every active user. Earlier admin Add calls always pinned the
+-- username at creation, which permanently excluded those rows from
+-- ListForSync. Going forward, only explicit username changes (admin Update
+-- via SetUsername) pin the row; sync will be a no-op when the kind:0
+-- profile already matches the stored handle.
+UPDATE users SET manual_username = 0 WHERE manual_username = 1;