feat: let users change their auto-generated username in Settings

Usernames are auto-assigned at signup (shipped earlier this session)
but there was still no way to change one. Adds a Username field to
Settings, validated client- and server-side against the same
3-20-char lowercase/digits/underscore pattern used for generation,
with a 409 on collision (excluding the user's own current username).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/users/me/route.ts

@@ -4,6 +4,7 @@ import { auth } from "@/lib/auth/server";
 import { db, users, eq } from "@epicure/db";
 import { z } from "zod";
 import { gravatarUrl } from "@/lib/gravatar";
+import { USERNAME_PATTERN, isUsernameTaken } from "@/lib/username";
 
 const PatchSchema = z.object({
   name: z.string().min(1).max(100).optional(),
@@ -11,6 +12,7 @@ const PatchSchema = z.object({
   bio: z.string().max(500).optional().nullable(),
   privateBio: z.string().max(2000).optional().nullable(),
   isPrivate: z.boolean().optional(),
+  username: z.string().trim().toLowerCase().regex(USERNAME_PATTERN, "3-20 characters, lowercase letters, numbers, and underscores only").optional(),
   // A custom-uploaded avatar URL, or null to revert to the Gravatar fallback.
   avatarUrl: z.string().url().max(2048).optional().nullable(),
 });
@@ -22,6 +24,10 @@ export async function PATCH(req: Request) {
   const body = PatchSchema.safeParse(await req.json());
   if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
 
+  if (body.data.username !== undefined && (await isUsernameTaken(body.data.username, session.user.id))) {
+    return NextResponse.json({ error: "Username already taken" }, { status: 409 });
+  }
+
   const { avatarUrl, ...rest } = body.data;
   const updates: Partial<typeof users.$inferInsert> = { ...rest };
   if (avatarUrl !== undefined) {