fix(social): normalize username lookup on POST /api/social/requests

Registration canonicalizes usernames to lowercase (auth.ts:32),
but the friend-request endpoint compared with strict eq() against
raw user input, so 'Bob' returned 404 even when 'bob' existed.
Trim and lowercase before lookup, matching the rest of the auth
boundary. Empty-after-trim now returns 400 (was: 404).

Tests appended to social.test.ts as a second describe block
sharing the harness from Task 1.

packages/server/src/routes/social.ts

@@ -119,12 +119,18 @@ export async function socialRoutes(app: FastifyInstance): Promise<void> {
     const { username } = request.body;
     const db = getDb();
 
-    if (!username) {
+    if (!username || typeof username !== 'string') {
+      return reply.code(400).send({ error: 'Username is required', statusCode: 400 });
+    }
+
+    // Match the canonical-lowercase form used by auth (auth.ts:32, 211, 256).
+    const lookupUsername = username.trim().toLowerCase();
+    if (!lookupUsername) {
       return reply.code(400).send({ error: 'Username is required', statusCode: 400 });
     }
 
     // Find the target user
-    const targetUser = db.select().from(schema.users).where(eq(schema.users.username, username)).get();
+    const targetUser = db.select().from(schema.users).where(eq(schema.users.username, lookupUsername)).get();
     if (!targetUser) {
       return reply.code(404).send({ error: 'User not found', statusCode: 404 });
     }