feat: harden the myep OAuth2 login

migrations/Version20260923090000.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260923090000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Adds myep\'s sub claim and a local lockout flag to user';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE `user` ADD sub VARCHAR(64) DEFAULT NULL, ADD disabled_at DATETIME DEFAULT NULL, ADD disabled_reason VARCHAR(255) DEFAULT NULL');
+        $this->addSql('CREATE UNIQUE INDEX uniq_user_sub ON `user` (sub)');
+
+        // Existing rows keep a NULL sub and are matched on their address once more, on their next
+        // login, which is where the column is backfilled. The unique index tolerates that: NULL
+        // is not equal to NULL in MySQL, so any number of rows may be waiting for their first
+        // login at once.
+
+        // Addresses were stored as they arrived, and the new matching normalises before it
+        // compares -- a row left in mixed case would never be found again.
+        $this->addSql('UPDATE `user` SET email = LOWER(TRIM(email))');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('DROP INDEX uniq_user_sub ON `user`');
+        $this->addSql('ALTER TABLE `user` DROP sub, DROP disabled_at, DROP disabled_reason');
+    }
+}