-- Google SSO can't collect a username before the OAuth redirect happens
-- (unlike email/password signup, where we pass it as signup metadata) --
-- so a first-time Google sign-in's profile row is created with no username,
-- and the app prompts for one right after (a "complete your profile" gate,
-- the same hard-gate spirit as email verification). The uniqueness
-- constraint still holds; Postgres treats multiple NULLs as distinct, so
-- several pending Google sign-ins can coexist before choosing a username.
alter table public.profiles alter column username drop not null;