fix: harden user linking and session pruning

Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims

Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9

drizzle/0003_thick_otto_octavius.sql

@@ -10,6 +10,7 @@ CREATE TABLE `auth_sessions` (
 --> statement-breakpoint
 ALTER TABLE `users` ADD `role` text DEFAULT 'member' NOT NULL;--> statement-breakpoint
 ALTER TABLE `users` ADD `headscale_user_id` text;--> statement-breakpoint
+CREATE UNIQUE INDEX `users_headscale_user_id_unique` ON `users` (`headscale_user_id`);--> statement-breakpoint
 ALTER TABLE `users` ADD `created_at` integer;--> statement-breakpoint
 ALTER TABLE `users` ADD `updated_at` integer;--> statement-breakpoint
 ALTER TABLE `users` ADD `last_login_at` integer;--> statement-breakpoint

drizzle/meta/0003_snapshot.json

@@ -193,6 +193,11 @@
           "name": "users_sub_unique",
           "columns": ["sub"],
           "isUnique": true
+        },
+        "users_headscale_user_id_unique": {
+          "name": "users_headscale_user_id_unique",
+          "columns": ["headscale_user_id"],
+          "isUnique": true
         }
       },
       "foreignKeys": {},