Phase 3.4: customers.display_name nullable + identity-only social scope

Drop NOT NULL on customers.display_name so phone-OTP and social signups can
land before the user picks a name; frontend then routes them to /auth/set-name.
Google sign-in no longer requests the name claim and Apple SDK scope is
trimmed to email only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/db/migrate.js

@@ -352,6 +352,10 @@ const migrate = async () => {
   await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_google_sub ON customers (google_sub) WHERE google_sub IS NOT NULL`
   await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_apple_sub ON customers (apple_sub) WHERE apple_sub IS NOT NULL`
 
+  // display_name is set after sign-in via the set-display-name screen for
+  // direct phone/Google/Apple sign-ups (no anonymous bootstrap). Allow null.
+  await sql`ALTER TABLE customers ALTER COLUMN display_name DROP NOT NULL`
+
   // Control center users: password-based auth columns
   // firebase_uid stays for backward compat during migration; will be dropped in a later cleanup migration
   await sql`ALTER TABLE control_center_users ALTER COLUMN firebase_uid DROP NOT NULL`