perf(users): rebuild user index with one shared scan and a bulk write

[MorquinDevlar]

What this does

Startup currently pays two full passes over every user file:

1. The user index rebuild unmarshals each file into a complete UserRecord, then appends records to users.idx one at a time - each AddUser call opens the file, appends, rewrites the header, and fsyncs. The existing BenchmarkAddUser clocks that at ~3.7ms per record on a fast SSD.
2. CharacterIndex.Rebuild() runs a second full unmarshal of every user file on every boot, including copyovers, just to extract active character names.

This PR feeds both indexes from one lightweight scan that decodes only userid, username, and the active character name, and writes the user index in one atomic pass (temp file + rename, single fsync) with the directory checksum folded into the same write. The on-disk index format is unchanged, and the IsUpToDate checksum skip works exactly as before.

At 1000 users (~5-8KB files, warm cache) a boot-after-activity rebuild goes from roughly 4 seconds to roughly 0.12 seconds.

Also hardened

• A truncated index (crash mid-AddUser) with an intact header could previously pass the checksum test while loadRecords silently failed, booting with empty maps - at which point GetUniqueUserId starts handing out userids that already belong to existing user files, and the next registration overwrites one of them. loadRecords now logs its failures, and IsUpToDate refuses to trust an index whose loaded record count disagrees with its header.
• One unreadable or malformed user file previously aborted the entire rebuild walk silently, truncating the index. The scan now skips such files with a warning.
• The scan warns about anomalies that usually mean hand-edited data: duplicate userids, duplicate usernames, and numeric filenames that disagree with the userid inside the file.

Compatibility

• On-disk index format unchanged (version 2).
• Old-format username.yaml files are still indexed - the scan reads content, not filenames.
• SearchOfflineUsers is untouched; UserIndex.Rebuild() and CharacterIndex.Rebuild() keep their signatures.

Numbers (Apple M5 Pro, warm cache)

	current	this PR
Parse per file (stock admin user file)	123µs (full UserRecord) x2 passes	90µs x1 pass
Index write, 1000 users	~3.7s (fsync per record)	~5ms (one write)
Boot after activity, 1000 users	~4s	~0.12s

Reproduce with:

go test -bench 'BenchmarkRebuildFromScan|BenchmarkScanVsFullUnmarshal|BenchmarkAddUser' -run '^$' ./internal/users/

BenchmarkScanRealUsers also accepts BENCH_USERS_DIR=/path/to/users to measure against a real users directory (read-only - the index it writes goes to a temp dir).

Tests

• Scan correctness: valid files, old-format files, alt/malformed/id-less files skipped.
• Rebuild round-trip: records, lookup maps, highest userid, and checksum survive a write/reload cycle.
• Stale entries do not survive a rebuild.
• A truncated index is never reported up to date.