fix(api): skip writing back an unchanged preferred namespace on login

[luizhf42]

Summary

Stacked on #7378 so the cloud e2e job runs with the billing test already fixed. The two changes don't depend on each other.

AuthLocalUser reads the user's preferred namespace and then writes it back, changed or not. If the namespace is deleted between the read and the write, ON DELETE SET NULL clears the column, the write puts the deleted ID back, and the foreign key turns login into a 500.

 AuthLocalUser
   ns := NamespaceGetPreferred(user)          # reads namespace X
   ...                                        # namespace X deleted here, column set to NULL
-  UserUpdatePreferredNamespace(user, X)      # FK violation, login answers 500
+  if user.PreferredNamespace != tenantID     # X == X, nothing to write
+    UserUpdatePreferredNamespace(user, tenantID)

CreateUserToken already does this check.

Evidence

• Before: the cloud e2e job on test(ui): accept a final invoice Stripe already finalized #7378 failed in billing.spec.ts:377 "a namespace with an active subscription is deleted only once it is canceled". The test polls login right after deleting the namespace, and the server logged:
  POST /api/login 500 ... violates foreign key constraint "users_preferred_namespace_id_fkey"
• After: four TestService_AuthLocalUser cases no longer expect a write of the unchanged value, so a write back fails them. Against the old auth.go, "succeeds to authenticate without a namespace" fails. With the fix, all of server/api/services passes.

The race is still there when the value changes: a user with no preferred namespace whose login picks a namespace being deleted at that moment. That window is much narrower, and nothing has hit it.

Merge Danger

Door: two-way

Blast Radius: login

Login skips a write that stored the value already in the column. The token and its claims are unchanged.

[github-actions]

Claude finished @luizhf42's task in 1m 15s —— View job

---

Code Review Complete

I reviewed 2 files for Standards (repo rules, Go conventions, tests, code smells) and Correctness (security and runtime defects). I found no new issues, and the code looks good as it is. The Spec axis did not run because the PR references no issue. I did all of the review myself rather than splitting it across the four sub-agents the procedure calls for, because the diff is 22 lines.

What I checked:

• The fix works. The full-row UserUpdate can't put the deleted namespace back. entity.UserPreferences.PreferredNamespace carries bun:"...,skipupdate" (server/api/store/pg/entity/user.go:36), so UserUpdatePreferredNamespace was the only write that could, and the new guard at server/api/services/auth.go:600 skips it when the value hasn't changed. The guard also matches the one in CreateUserToken (auth.go:672).
• The tests still cover both cases. The "empty preferred namespace" case (auth_test.go:2022) still expects a write. The unchanged-value cases now set no expectation for UserUpdatePreferredNamespace, so an extra write back would hit a mock with no matching expectation and fail the test.
• Cloud is unaffected. No exported symbol changed.

[gustavosbarreto]

/review

[github-actions]

Claude finished @gustavosbarreto's task in 1m 10s —— View job

---

Code Review Complete

Reviewed 2 files for Standards (repo rules, Go conventions, tests, code smells) and Correctness (security and runtime defects). I found no new issues, and the code looks good as it is. The Spec axis did not run because the PR and its commit reference no issue.