fix(social): normalize username lookup on POST /api/social/requests

Registration canonicalizes usernames to lowercase (auth.ts:32),
but the friend-request endpoint compared with strict eq() against
raw user input, so 'Bob' returned 404 even when 'bob' existed.
Trim and lowercase before lookup, matching the rest of the auth
boundary. Empty-after-trim now returns 400 (was: 404).

Tests appended to social.test.ts as a second describe block
sharing the harness from Task 1.

packages/server/src/routes/social.test.ts

@@ -159,3 +159,57 @@ describe('GET /api/social/search — filter hygiene', () => {
     expect(out.map(u => u.id)).toContain('u1');
   });
 });
+
+describe('POST /api/social/requests — case-insensitive username lookup', () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    sqlite = new Database(':memory:');
+    testDb = drizzle(sqlite, { schema });
+    applyMigrations(sqlite);
+    seedUser({ id: CALLER_ID, username: 'caller' });
+    // Target stored canonically lowercase, as registration would write it.
+    seedUser({ id: 'target-id', username: 'bob' });
+    app = await buildApp();
+  });
+
+  async function sendRequest(username: string) {
+    return app.inject({
+      method: 'POST',
+      url: '/api/social/requests',
+      payload: { username },
+    });
+  }
+
+  it('finds the target when the caller types the exact stored handle', async () => {
+    const res = await sendRequest('bob');
+    expect(res.statusCode).toBe(201);
+    const inserted = testDb.select().from(schema.friendRequests)
+      .where(eq(schema.friendRequests.toId, 'target-id')).get();
+    expect(inserted).toBeTruthy();
+  });
+
+  it('finds the target when the caller types a mixed-case handle', async () => {
+    const res = await sendRequest('Bob');
+    expect(res.statusCode).toBe(201);
+    const inserted = testDb.select().from(schema.friendRequests)
+      .where(eq(schema.friendRequests.toId, 'target-id')).get();
+    expect(inserted).toBeTruthy();
+  });
+
+  it('finds the target when the caller types an all-uppercase handle', async () => {
+    const res = await sendRequest('BOB');
+    expect(res.statusCode).toBe(201);
+  });
+
+  it('trims surrounding whitespace before lookup', async () => {
+    const res = await sendRequest('  bob  ');
+    expect(res.statusCode).toBe(201);
+  });
+
+  it('returns 404 when the handle does not exist', async () => {
+    const res = await sendRequest('nobody');
+    expect(res.statusCode).toBe(404);
+    expect(JSON.parse(res.body).error).toBe('User not found');
+  });
+});

packages/server/src/routes/social.ts

@@ -119,12 +119,18 @@ export async function socialRoutes(app: FastifyInstance): Promise<void> {
     const { username } = request.body;
     const db = getDb();
 
-    if (!username) {
+    if (!username || typeof username !== 'string') {
+      return reply.code(400).send({ error: 'Username is required', statusCode: 400 });
+    }
+
+    // Match the canonical-lowercase form used by auth (auth.ts:32, 211, 256).
+    const lookupUsername = username.trim().toLowerCase();
+    if (!lookupUsername) {
       return reply.code(400).send({ error: 'Username is required', statusCode: 400 });
     }
 
     // Find the target user
-    const targetUser = db.select().from(schema.users).where(eq(schema.users.username, username)).get();
+    const targetUser = db.select().from(schema.users).where(eq(schema.users.username, lookupUsername)).get();
     if (!targetUser) {
       return reply.code(404).send({ error: 'User not found', statusCode: 404 });
     }