googleSub UNIQUE partial index after EVO-74 dedup

Add a UNIQUE partial index on users(googleSub) WHERE googleSub IS NOT NULL AND deletedAt IS NULL as the structural anti-dup guard for the Google cross-app person key. PREREQUISITE: EVO-74 duplicate-account dedup must run first — the index CREATE will fail if any pre-existing duplicate live rows already share a googleSub (the very bug EVO-74 closes may have created some). venus54 (EVO-79) added users.googleSub nullable + backfill from auth.users identities[].sub and stamps it at attach/create (first-login stamp lands with the L3 Class-A batch); the column is currently a correlation key with NO uniqueness enforcement. Order: EVO-74 dedup sweep → verify 0 duplicate live googleSub → add unique partial index.