Add reviewed duplicate account consolidation and prevent duplicate imports

backend/app/db.py

@@ -187,6 +187,9 @@ def _has_secure_bootstrap_admin_credentials() -> bool:
 
 def init_db() -> None:
     with _connect() as conn:
+        conn.execute("""CREATE TABLE IF NOT EXISTS user_duplicate_repairs (
+            id INTEGER PRIMARY KEY AUTOINCREMENT, kept_user_id INTEGER NOT NULL,
+            archive_json TEXT NOT NULL, repaired_by TEXT NOT NULL, repaired_at TEXT NOT NULL)""")
         conn.execute("""CREATE TABLE IF NOT EXISTS user_feature_permissions (
             user_id INTEGER NOT NULL, feature TEXT NOT NULL, enabled INTEGER NOT NULL,
             PRIMARY KEY(user_id, feature))""")
@@ -1007,10 +1010,15 @@ def create_user(
     expires_at: Optional[str] = None,
     invited_by_code: Optional[str] = None,
 ) -> None:
+    username = str(username).strip()
     created_at = datetime.now(timezone.utc).isoformat()
     password_hash = hash_password(password)
     normalized_email = _normalize_stored_email(email)
     with _connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        if any(str(row[0]).strip().casefold() == username.casefold()
+               for row in conn.execute("SELECT username FROM users")):
+            raise sqlite3.IntegrityError("A normalized username already exists")
         conn.execute(
             """
             INSERT INTO users (
@@ -1061,10 +1069,15 @@ def create_user_if_missing(
     expires_at: Optional[str] = None,
     invited_by_code: Optional[str] = None,
 ) -> bool:
+    username = str(username).strip()
     created_at = datetime.now(timezone.utc).isoformat()
     password_hash = hash_password(password)
     normalized_email = _normalize_stored_email(email)
     with _connect() as conn:
+        conn.execute("BEGIN IMMEDIATE")
+        if any(str(row[0]).strip().casefold() == username.casefold()
+               for row in conn.execute("SELECT username FROM users")):
+            return False
         cursor = conn.execute(
             """
             INSERT OR IGNORE INTO users (
@@ -1126,6 +1139,7 @@ def get_user_by_username(username: str) -> Optional[Dict[str, Any]]:
                    jellyfin_password_hash, last_jellyfin_auth_at
             FROM users
             WHERE username = ? COLLATE NOCASE
+            ORDER BY id
             """,
             (username,),
         ).fetchone()