harden(db): case-insensitive email unique index + dup-email test; list_users pagination TODO; from_db note

crates/db/tests/users.rs

@@ -98,3 +98,29 @@ async fn list_users_is_ordered_by_email(pool: PgPool) {
     let emails: Vec<&str> = users.iter().map(|u| u.email.as_str()).collect();
     assert_eq!(emails, vec!["amy@example.com", "zoe@example.com"]);
 }
+
+#[sqlx::test]
+async fn duplicate_email_is_rejected(pool: PgPool) {
+    let db = Db::from_pool(pool);
+
+    let mut tx = db.pool().begin().await.unwrap();
+    users::create_user(
+        &mut tx,
+        AuditActor::System,
+        &new_user("anna@example.com", Role::Admin),
+    )
+    .await
+    .unwrap();
+    // Same normalized email again — the lower(email) unique index must reject it.
+    let err = users::create_user(
+        &mut tx,
+        AuditActor::System,
+        &new_user("anna@example.com", Role::Editor),
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        matches!(err, sqlx::Error::Database(_)),
+        "expected a unique-violation database error, got {err:?}"
+    );
+}