Postgres '=' is case-sensitive, so a user stored as 'Km...@gmail.com'
could not log in from a phone keyboard that lowercases the email field.
The lookup in AuthService returned null before Hash::check ever ran, so
this presented as "wrong password" and was invisible in login_history —
that table is only written once a user has been found.

On OC-Sport this affected 8 of 26 accounts, and had already produced one
duplicate registration: a user who could not get in simply signed up
again with the same address in lowercase.

- CredentialNormalizer: one canonical shape for emails and phones
- AuthService: case-insensitive email lookup, deterministically ordered
  so a pre-existing case-duplicate pair resolves to the account actually
  in use rather than an arbitrary row; phone lookup matches local and
  +20 forms
- User: set-mutators so new rows are stored canonical
- Migration: normalises existing rows, skipping and logging any that
  would collide, since those are duplicate accounts needing a human
  merge rather than a guess
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>