fix: no user ever had a username, so people search found nobody

Root cause of "still cannot find users": username was optional in
better-auth's schema and no signup form or settings page ever set it,
but search/profile/follow all key on username, not user id. Every
account now gets a unique one auto-generated (from name/email) in the
user.create.before hook — covers email/password and OAuth signups.
Added a one-off db:backfill-usernames script for accounts created
before this fix and ran it against the current database.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/auth/server.ts

@@ -6,6 +6,7 @@ import { sendEmail, verifyEmailHtml, resetPasswordHtml, welcomeHtml } from "@/li
 import { isSignupsDisabled } from "@/lib/site-settings";
 import { findValidInvite, consumeInvite, INVITE_COOKIE } from "@/lib/invites";
 import { gravatarUrl } from "@/lib/gravatar";
+import { generateUniqueUsername } from "@/lib/username";
 
 export const auth = betterAuth({
   trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"],
@@ -94,13 +95,21 @@ export const auth = betterAuth({
     user: {
       create: {
         before: async (user, context) => {
-          if (!(await isSignupsDisabled())) return;
+          // No signup form or settings page ever lets someone set a username,
+          // yet profiles, follows, and people-search all key on it — so every
+          // account needs one generated here, or those features silently see
+          // nobody. OAuth signups may already have one (mapped from the
+          // provider profile); email/password never does.
+          const existingUsername = (user as { username?: string | null }).username;
+          const username = existingUsername || (await generateUniqueUsername(user.name || user.email));
+
+          if (!(await isSignupsDisabled())) return { data: { ...user, username } };
 
           const token = context?.getCookie(INVITE_COOKIE);
           const invite = token ? await findValidInvite(token, user.email) : null;
           if (!invite) return false;
 
-          return { data: { ...user, role: invite.role, tier: invite.tier } };
+          return { data: { ...user, username, role: invite.role, tier: invite.tier } };
         },
         after: async (user, context) => {
           // First registered user becomes admin