feat(auth): auto-username on OAuth sign-in (discord/github/twitch)

[h0lybyte]

Summary

After a new OAuth sign-in (Discord / GitHub / Twitch, web + mobile), auto-claim the user's provider handle as their KBVE username. On collision the DB retries with a random suffix, so it almost always resolves silently + a welcome toast. Only handle-less accounts fall through to a friendly "Hey! We need you to create a username?" prompt.

Changes

• axum-kbve: new POST /api/v1/profile/username/auto (auto_claim_username_handler); base-handle resolver (hint → priority discord→github→twitch) + ProfileService::auto_claim_username; converged validate_username to the DB rule (^[a-z0-9_-]{3,63}$ — hyphens, leading digit, 3–63) so auto-claimed names round-trip. OpenAPI updated.
• SQL: new provider-neutral tracker.ensure_oauth_username (advisory-locked retry-with-suffix via service_add_username); ensure_discord_username untouched.
• @kbve/core: auth store fires api.auto_claim_username exactly once per session with the sign-in provider as a hint.
• @kbve/rn: both executors handle the effect — POST, welcome toast (Welcome! Your username is @handle — change it in settings.), refresh session. SetUsernameScreen gets the friendly copy, the converged regex, and suggestion + variant:'modal' props.

Spec / Plan

• docs/superpowers/specs/2026-07-09-discord-auto-username-design.md
• docs/superpowers/plans/2026-07-09-oauth-auto-username.md

Test evidence

• nx test axum-kbve: 74 passed (validator parity + base-handle resolver).
• nx test rn: 45 passed (SetUsernameScreen copy + suggestion prefill).
• core: vitest 3/3 (auth store fires once + provider hint); lint + typecheck clean.

Deploy / rollout notes

• PostgREST schema reload required after the migration (NOTIFY pgrst, 'reload schema') before ensure_oauth_username resolves — until then calls 404 and users fall through to the manual prompt (best-effort, no error surfaced).
• Migration applies via CI dbmate (not run against prod here).

Known follow-ups (non-blocking)

• Modal variant + suggestion prefill are implemented on SetUsernameScreen but AuthGate still renders the full-screen gate with the friendly title only. Wiring variant="modal" + a backend-returned sanitized suggestion on the claimed:false path is a small follow-up; deferred because it changes native onboarding UX.

Manual verification pending

End-to-end OAuth drive with fresh test accounts (auto-claim → toast → handle-less fallback) not run in this environment — needs a live backend + provider test accounts.