🐛(backend) prevent duplicate pending users on concurrent requests

Fix a race condition in the external viewset where concurrent requests
could create multiple pending users with the same email address.

No database constraint enforced email uniqueness for pending users,
allowing duplicates to be created under load.

This caused issues during user reconciliation, which expects a single
matching pending user and raises a warning when multiple records are
found.

Add a narrowly scoped migration to enforce the uniqueness constraint
and address the identified issue.

src/backend/core/models.py

@@ -211,6 +211,13 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
         ordering = ("-created_at",)
         verbose_name = _("user")
         verbose_name_plural = _("users")
+        constraints = [
+            models.UniqueConstraint(
+                models.functions.Lower("email"),
+                condition=models.Q(sub__isnull=True),
+                name="unique_email_when_sub_is_null",
+            )
+        ]
 
     def __str__(self):
         return self.email or self.admin_email or str(self.id)