Migration sets access rules, password min 8, name max 100, password-only
auth, and a case-insensitive unique email index. A hook rejects non-ASCII
and malformed emails on every save. API tests cover registration, login,
and isolation between two users and a guest.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
