Reserved names (#662) are checked at signup, edge sign-in, org founding and display-name change. A path added later (#668's linked methods, an import, an admin creating accounts) has to remember to call the check. The rule should live where accounts are made.
Acceptance criteria
[ ] createUser refuses a reserved name for every non-agent account, with username_reserved. Agents are named by the forge admin and keep their own rule.
[ ] Callers that seed accounts on purpose (a spawned child's admin, tests) pass an explicit, named opt-out. Nothing opts out by default.
[ ] The separate calls at signup, edge sign-in and org founding go away, so there is one place.
[ ] Test: each way in (signup page and API, edge sign-in, an org, any new path) refuses an agent's name and a look-alike of the owner's, and a seeded account with the opt-out is still made.
Reserved names (#662) are checked at signup, edge sign-in, org founding and display-name change. A path added later (#668's linked methods, an import, an admin creating accounts) has to remember to call the check. The rule should live where accounts are made.
Acceptance criteria
createUserrefuses a reserved name for every non-agent account, withusername_reserved. Agents are named by the forge admin and keep their own rule.