feat: disciple link

migrations/0045_add_users_disciple_id.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS users_disciple_id_key;
+
+ALTER TABLE users
+    DROP COLUMN IF EXISTS disciple_id;

migrations/0045_add_users_disciple_id.up.sql

@@ -0,0 +1,19 @@
+-- Direct-disciple linkage. Śrīla Prabhupāda's own initiated disciples have
+-- started joining the platform; an admin links their account to the matching
+-- row in the Mongo `disciples` collection so the site can mark them
+-- authentically (a badge on their profile, a highlight in /disciples).
+--
+-- disciple_id holds the Mongo ObjectID hex (24 chars). It's a cross-store
+-- reference, so no foreign key is possible — the admin endpoint validates the
+-- id exists in Mongo before writing, and a dangling id degrades gracefully
+-- (the name simply doesn't hydrate).
+--
+-- The partial UNIQUE index enforces the one-to-one rule: a given disciple can
+-- be claimed by at most one account, so two users can't both present as the
+-- same disciple. NULLs are unconstrained, which leaves the overwhelming
+-- majority of users unaffected and keeps the index tiny.
+ALTER TABLE users
+    ADD COLUMN IF NOT EXISTS disciple_id TEXT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS users_disciple_id_key
+    ON users (disciple_id) WHERE disciple_id IS NOT NULL;

migrations/0046_create_disciple_announcements.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS disciple_announcements;

migrations/0046_create_disciple_announcements.up.sql

@@ -0,0 +1,20 @@
+-- One row per account whose arrival as a direct disciple of Śrīla Prabhupāda
+-- has been announced to the community.
+--
+-- This table exists purely for idempotency. Announcing writes a notification
+-- to *every* user, so it must happen at most once per devotee — not again when
+-- an admin corrects which disciple record they're linked to, not again on a
+-- double-clicked button, and not again if the process restarts mid-fan-out.
+-- The insert is `ON CONFLICT DO NOTHING` and only a caller that actually
+-- inserted the row goes on to broadcast, which makes the guard atomic.
+--
+-- Keyed on user_id (not disciple_id) deliberately: we are announcing that a
+-- *person* has joined. Re-pointing their link at a different disciple record
+-- corrects a mistake; it isn't a second arrival.
+CREATE TABLE IF NOT EXISTS disciple_announcements (
+    user_id      UUID        PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    -- The Mongo disciple ObjectID they were linked to at announcement time,
+    -- kept for auditing (which record prompted the announcement).
+    disciple_id  TEXT        NOT NULL,
+    announced_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);