feat(forum): accept a reserved username for the account that owns it

[SomethingNew71]

Summary

The forum SSO route accepts a reserved username only for the account that owns it (reserved_username_owners, service-role only, in the private supabase repo). The table is read only when the stored username is on the reserved list. Everyone else still gets 409 username_required.

• server/api/discourse/sso.post.ts: well-formed check, then the owner lookup for reserved names (read error → 503).
• shared/utils/usernames.ts: isWellFormedForumUsername().
• types/database.ts: regenerated (+22 lines: the new table and reserved_usernames()).
• Plan doc: short AS-BUILT note.

Test plan

• bun run test: 288 files, 6731 tests pass (3 new: owner signs in with the reserved name; owner read error → 503; non-reserved names never read the table)
• typecheck: no change against baseline; prettier check clean
• After deploy: owner signs out of the forum and back in; forum username becomes classicminidiy

🤖 Generated with Claude Code