feat: admin endpoints to reset username sync flags

Add POST /v1/admin/users/{pubkey}/reset-username and
POST /v1/admin/users/reset-usernames to clear manual_username
and last_synced_at so nostr profile sync re-evaluates users.
Includes OpenAPI docs, audit actions, and tests.

internal/user/repo.go

@@ -133,6 +133,20 @@ func (r *Repo) Delete(ctx context.Context, pubkey string) error {
 	return err
 }
 
+// ResetAllSyncFlags clears manual_username and last_synced_at for every active
+// user so the profile sync worker re-evaluates them on its next tick. Returns
+// the number of affected rows.
+func (r *Repo) ResetAllSyncFlags(ctx context.Context) (int64, error) {
+	res, err := r.db.ExecContext(ctx, `UPDATE users SET
+        manual_username = 0,
+        last_synced_at = NULL
+        WHERE is_active = 1`)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
 // SetActiveExpiry sets a user's expires_at to an absolute value and reactivates
 // them. Idempotent: applying the same input twice produces the same end state.
 func (r *Repo) SetActiveExpiry(ctx context.Context, pubkey string, sub SubscriptionType, expiresAt *time.Time) error {