fix(auth): add @Email validation and @Valid to enforce email format on user creation

- Add @Email annotation to CreateUserRequest.email and AppUser.email
- Add @Valid to UserController.createUser to activate bean validation
- Add MigrationIntegrationTest cases for V44 NOT NULL and UNIQUE constraints
- Fix stale test comments (findByUsername → findByEmail)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/controller/UserController.java

@@ -4,6 +4,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 
+import jakarta.validation.Valid;
 import org.raddatz.familienarchiv.dto.AdminUpdateUserRequest;
 import org.raddatz.familienarchiv.dto.ChangePasswordDTO;
 import org.raddatz.familienarchiv.dto.CreateUserRequest;
@@ -77,7 +78,7 @@ public class UserController {
 
     @PostMapping("/users")
     @RequirePermission(Permission.ADMIN_USER)
-    public ResponseEntity<AppUser> createUser(@RequestBody CreateUserRequest request) {
+    public ResponseEntity<AppUser> createUser(@Valid @RequestBody CreateUserRequest request) {
         return ResponseEntity.ok(userService.createUserOrUpdate(request));
     }
 

backend/src/main/java/org/raddatz/familienarchiv/dto/CreateUserRequest.java

@@ -1,5 +1,6 @@
 package org.raddatz.familienarchiv.dto;
 
+import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Pattern;
 import lombok.Data;
@@ -11,6 +12,7 @@ import java.util.UUID;
 @Data
 public class CreateUserRequest {
     @NotBlank
+    @Email
     @Pattern(regexp = "^[^:]+$", message = "Email must not contain a colon")
     private String email;
     private String initialPassword;

backend/src/main/java/org/raddatz/familienarchiv/model/AppUser.java

@@ -1,6 +1,7 @@
 package org.raddatz.familienarchiv.model;
 
 import jakarta.persistence.*;
+import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Pattern;
 import lombok.*;
@@ -33,6 +34,7 @@ public class AppUser {
 
     @Column(unique = true, nullable = false)
     @NotBlank
+    @Email
     @Pattern(regexp = "^[^:]+$", message = "Email must not contain a colon")
     @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
     private String email;