feat: admin endpoints to reset username sync flags

Add POST /v1/admin/users/{pubkey}/reset-username and
POST /v1/admin/users/reset-usernames to clear manual_username
and last_synced_at so nostr profile sync re-evaluates users.
Includes OpenAPI docs, audit actions, and tests.

internal/user/service.go

@@ -100,6 +100,29 @@ func (s *Service) Delete(ctx context.Context, pubkey string) error {
 	return s.repo.Delete(ctx, pubkey)
 }
 
+// ResetUsername clears the manual_username pin and last_synced_at cooldown for
+// a single user so the next profile sync cycle re-evaluates their kind:0
+// metadata. The stored username is left untouched until the worker overwrites
+// it. Returns the updated user.
+func (s *Service) ResetUsername(ctx context.Context, pubkey string) (*User, error) {
+	u, err := s.repo.GetByPubkey(ctx, pubkey)
+	if err != nil {
+		return nil, err
+	}
+	u.ManualUsername = false
+	u.LastSyncedAt = nil
+	if err := s.repo.Update(ctx, u); err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// ResetAllUsernames clears manual_username and last_synced_at for every active
+// user. Returns the number of affected rows.
+func (s *Service) ResetAllUsernames(ctx context.Context) (int64, error) {
+	return s.repo.ResetAllSyncFlags(ctx)
+}
+
 // computeExpiry returns *time.Time (nil for lifetime).
 func computeExpiry(sub SubscriptionType, years int, current time.Time, now time.Time) *time.Time {
 	if sub == SubLifetime {