fix: allow profile sync for admin-created users

Stop pinning usernames on admin Add (manual_username=false) so sync matches
invoice-created users. Add migration to reset manual_username for existing
rows so they re-enter ListForSync; explicit renames still pin via SetUsername.

internal/http/handlers/admin_users.go

@@ -66,7 +66,7 @@ func (h *AdminUsers) Add(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, true)
+	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, false)
 	if err != nil {
 		if errors.Is(err, user.ErrInvalidUsername) {
 			WriteError(w, http.StatusBadRequest, "ValidationError", "invalid username")