fix(api): scope user-subscriber reads to entity_type 'User'; unbreak main CI

[rickyrombo]

What

Four related fixes around the overloaded subscriptions.user_id column (it mirrors the event id for Event rows, and event ids are allocated independently of user ids). Background: #1011 seeded production's subscriptions_current_uniq_idx into the test schema, which both broke main's CI and led to the discovery of the bugs below (see OpenAudio/go-openaudio#469 for the upstream identity fix).

1. Live bug: event followers counted as user subscribers. /v1/users/{id}/subscribers and the upload-notification fan-outs in handle_track / handle_playlist match on user_id alone. A follower of event N therefore counts as a subscriber of user N whenever the ids collide — they appear in the subscriber list and get "new upload" notifications for an artist they never subscribed to. Reachable today with a single Event row; go-openaudio#469 (which legalizes cross-type coexistence) widens the exposure. Fixed by adding entity_type = 'User' to all three readers (trigger functions updated in ddl/functions/, which pg_migrate.sh re-applies on md5 change, with the schema dump edited to match). The Event-side readers were already correctly scoped since #977; this is the mirror image nobody did.

2. Unbreak main CI. The events-followers fixture seeds a legacy User-type row sharing (subscriber_id, user_id) with a deleted-event row — illegal under the index #1011 seeded, so database.Seed panics. The legacy row moves to its own subscriber; both exclusion behaviors stay covered. Once go-openaudio#469 widens the index to include entity_type, the same-subscriber collision becomes legal again and is worth re-adding (noted in a comment).

2b. Same bug in does_current_user_subscribe. The current_user_subscribed_targets CTE in get_users.sql also matched on user_id alone, so a viewer following event N showed as subscribed to user N on every user-list surface. Same entity_type = 'User' fix (sqlc regenerated). Note: this CTE filters only is_delete and not is_current, unlike the other readers — that predates the #892 refactor and is left as-is here.

3. Close the cache hole that let this merge green. setup-go restores the go-build cache (including test results) keyed on go.sum, but the test schema lives in dockerized Postgres, invisible to Go's cache invalidation — so #1011's sql/-only commits rode a stale green while its own schema change broke a test. -count=1 forces tests to actually run.

Tests

• TestUsersSubscribers now seeds an Event subscription whose event id collides with the artist's user id and asserts the follower is not listed (fails without the filter).
• TestUserQuery_DoesCurrentUserSubscribeIgnoresEventSubscriptions seeds a colliding Event subscription and asserts the flag stays false (fails without the filter).
• TestEventsFollowers_ReturnsOnlyLiveEventSubscribers passes again (was panicking on main).
• Full suite green locally with -count=1 against a freshly initialized schema volume.

Not in this PR

The pkg/etl pin bump + seeded-index update land separately once go-openaudio#469/#470 cut a release.

🤖 Generated with Claude Code