Normalize email case on user creation and login

Users created with uppercase letters in their email were stored as-is,
while login lowercased the input, locking them out. Store emails in
lowercase and match case-insensitively so existing users can log in.

Fixes #4983

backend/internal/token.js

@@ -29,7 +29,7 @@ export default {
 
 		const user = await userModel
 			.query()
-			.where("email", data.identity.toLowerCase().trim())
+			.whereRaw("LOWER(email) = ?", [data.identity.toLowerCase().trim()])
 			.andWhere("is_deleted", 0)
 			.andWhere("is_disabled", 0)
 			.first();

backend/internal/user.js

@@ -34,6 +34,10 @@ const internalUser = {
 			data.is_disabled = data.is_disabled ? 1 : 0;
 		}
 
+		if (typeof data.email === "string") {
+			data.email = data.email.toLowerCase().trim();
+		}
+
 		await access.can("users:create", data);
 		data.avatar = gravatar.url(data.email, { default: "mm" });
 

backend/setup.js

@@ -38,7 +38,7 @@ const setupDefaultUser = async () => {
 
 		const data = {
 			is_deleted: 0,
-			email: initialAdminEmail,
+			email: initialAdminEmail.toLowerCase().trim(),
 			name: "Administrator",
 			nickname: "Admin",
 			avatar: "",