fix: make username login case-insensitive (#3981)

Normalize usernames to lowercase on lookup, creation, and update.
Also fix variable shadowing bug and same-user update check in
the user update endpoint.

src/app/api/users/[userId]/route.ts

@@ -59,14 +59,14 @@ export async function POST(request: Request, { params }: { params: Promise<{ use
   }
 
   if (username && auth.user.isAdmin) {
-    data.username = username;
+    data.username = username.toLowerCase();
   }
 
   // Check when username changes
   if (data.username && user.username !== data.username) {
-    const user = await getUserByUsername(username);
+    const existingUser = await getUserByUsername(data.username);
 
-    if (user) {
+    if (existingUser && existingUser.id !== userId) {
       return badRequest({ message: 'User already exists' });
     }
   }

src/app/api/users/route.ts

@@ -35,7 +35,7 @@ export async function POST(request: Request) {
 
   const user = await createUser({
     id: id || uuid(),
-    username,
+    username: username.toLowerCase(),
     password: hashPassword(password),
     role: role ?? ROLES.user,
   });

src/queries/prisma/user.ts

@@ -42,7 +42,7 @@ export async function getUser(userId: string, options: GetUserOptions = {}) {
 }
 
 export async function getUserByUsername(username: string, options: GetUserOptions = {}) {
-  return findUser({ where: { username } }, options);
+  return findUser({ where: { username: username.toLowerCase() } }, options);
 }
 
 export async function getUsers(criteria: UserFindManyArgs, filters: QueryFilters = {}) {