fix(auth): allow admins to change any username including their own

apps/web/src/test/fakeApi.ts

@@ -243,6 +243,13 @@ export function fakeApi(initial: FakeUser[]) {
       if (!user || user.role === 'user') return problem(403, 'auth.forbidden');
       const target = users.get(userPath[1]!);
       if (!target) return problem(404, 'common.not_found');
+      if (typeof body?.username === 'string') {
+        if (user.role !== 'admin') return problem(403, 'auth.forbidden');
+        const username = body.username.trim().toLowerCase();
+        if ([...users.values()].some((u) => u.id !== target.id && u.username.toLowerCase() === username))
+          return problem(422, 'auth.username_taken', { errors: [{ field: 'username', code: 'auth.username_taken' }] });
+        target.username = username;
+      }
       if (typeof body?.reviews_uploads === 'boolean') {
         if (user.role !== 'admin') return problem(403, 'auth.forbidden');
         target.reviews_uploads = body.reviews_uploads;