-- Some auth providers (Facebook in particular) let users sign up without
-- linking a verified email — phone-only accounts and accounts whose owner
-- declined the `email` permission both fall under this. To accept those
-- users we need to allow NULL on users.email.
--
-- The UNIQUE constraint stays put: Postgres treats NULLs as distinct under
-- a regular UNIQUE index (multiple rows with NULL email are allowed) so
-- nothing breaks for OAuth-only users with no address on file. Real email
-- addresses are still de-duplicated, exactly as before.
ALTER TABLE users ALTER COLUMN email DROP NOT NULL;