feat(auth): enforce username uniqueness at startup and config reload

[taigrr]

Summary

Adds validation to reject farmer configs where two or more pubkeys share the same username. Duplicate usernames make audit logs ambiguous — this catches the misconfiguration early.

Changes

• internal/rbac/config.go: Add ErrDuplicateUsername sentinel error and ValidateUsernameUniqueness() function that scans the users config section for duplicate username assignments across all roles.
• internal/auth/auth.go: Wire ValidateUsernameUniqueness() into LoadPolicy(), which runs at farmer startup and on SIGHUP config reload.
• Tests: 6 unit tests for the validator + 2 integration tests for LoadPolicy.

Behavior

• At farmer startup: duplicate usernames cause a fatal error (farmer refuses to start).
• On SIGHUP reload: duplicate usernames are logged as an error and the policy reload is rejected (existing policy remains in effect).
• Empty/missing usernames are ignored — only explicitly configured usernames are checked.
• Works with both simple and rich user config formats.

Config example that would be rejected

users:
  admin:
    - pubkey: APUBKEY1
      username: alice
  viewer:
    - pubkey: APUBKEY2
      username: alice  # ERROR: duplicate username