feat(user): add given_name/family_name auth.users

reflect OIDC
  schema migration, User entity additions, and three defense-in-depth gaps closed, with all 280 unit tests and 13 Hurl files green
  infrastructure (lettre + EmailSender port).

  - Migration migrations/20260612000003_users_username_email_login.sql — adds nullable given_name/family_name columns to auth.users.
  - User entity (src/domain/entities/user.rs) — has_login_credential() placeholder-check encapsulation, set_username revalidating setter, given/family-name fields + getters/setters, validate_username widened 32→254 and now accepts email shape.
  from_data_full extended with two new params; all 7 callsites in user_pg_repository.rs updated.
  - Schema-side legacy guards (src/application/services/auth_application_service.rs) — bumped the duplicated 32-char check in setup_create_admin and admin_create_user to 254 to match.
  - Gap #1 (subject_group_service.rs) — add_member now rejects external candidates with an audit-logged AccessDenied. Service gained an Arc<UserPgRepository> field, wired through DI. New integration test test_external_user_cannot_be_added_as_member.
  - Gap #2 (user_repository.rs + auth_ports.rs + user_pg_repository.rs) — list_users/search_users gained an include_external: bool param defaulting effectively to false everywhere internal-user-facing. auth_application_service exposes a new
  list_users_including_external for the admin surface.
  - Gap #3 (pg_acl_engine.rs) — expand_user now SELECTs is_external and skips INTERNAL_GROUP_ID for externals; defaults to is_external=true on missing user to fail closed.

src/application/services/auth_application_service.rs

@@ -312,11 +312,11 @@ impl AuthApplicationService {
         password: String,
     ) -> Result<UserDto, DomainError> {
         // Validate username
-        if username.len() < 3 || username.len() > 32 {
+        if username.len() < 3 || username.len() > 254 {
             return Err(DomainError::new(
                 ErrorKind::InvalidInput,
                 "User",
-                "Username must be between 3 and 32 characters".to_string(),
+                "Username must be between 3 and 254 characters".to_string(),
             ));
         }
 
@@ -773,13 +773,30 @@ impl AuthApplicationService {
         Ok(admin_users.len() as i64)
     }
 
+    /// Lists internal users only. External (grant-only) users are filtered
+    /// out so that internal-user surfaces — system address book, OCS
+    /// sharee search, etc. — never expose external identities. Admin
+    /// surfaces that need the full list should call
+    /// [`list_users_including_external`] instead.
     pub async fn list_users(&self, limit: i64, offset: i64) -> Result<Vec<UserDto>, DomainError> {
-        let users = self.user_storage.list_users(limit, offset).await?;
+        let users = self.user_storage.list_users(limit, offset, false).await?;
         Ok(users.into_iter().map(UserDto::from).collect())
     }
 
+    /// Admin-only: lists users including external (grant-only) recipients.
+    /// Used by the admin user-management UI.
+    pub async fn list_users_including_external(
+        &self,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<UserDto>, DomainError> {
+        let users = self.user_storage.list_users(limit, offset, true).await?;
+        Ok(users.into_iter().map(UserDto::from).collect())
+    }
+
+    /// Searches internal users only. See [`list_users`] for the rationale.
     pub async fn search_users(&self, query: &str, limit: i64) -> Result<Vec<UserDto>, DomainError> {
-        let users = self.user_storage.search_users(query, limit).await?;
+        let users = self.user_storage.search_users(query, limit, false).await?;
         Ok(users.into_iter().map(UserDto::from).collect())
     }
 
@@ -793,11 +810,11 @@ impl AuthApplicationService {
         dto: crate::application::dtos::settings_dto::AdminCreateUserDto,
     ) -> Result<UserDto, DomainError> {
         // Validate username length
-        if dto.username.len() < 3 || dto.username.len() > 32 {
+        if dto.username.len() < 3 || dto.username.len() > 254 {
             return Err(DomainError::new(
                 ErrorKind::InvalidInput,
                 "User",
-                "Username must be between 3 and 32 characters".to_string(),
+                "Username must be between 3 and 254 characters".to_string(),
             ));
         }