fix(api): a misshapen id is bad input, not a server fault

Ids are stored in a fixed-width column, so an overlong one is refused by
Postgres rather than simply matching nothing. That refusal is not a foreign-key
violation, so it fell through to the global error boundary and reached the
caller as a 500 — telling a host to retry something that can never succeed.
Measured: a 44-character user id returned 500, where an absent but well-formed
one correctly returned 404.

`Identifier.schema` is the natural place for the check and had no callers yet,
so it now asserts the exact width an id has as well as its prefix — including
the separator, without which `usrsomething` reads as a user id. The enrolment
schema uses it for both foreign keys, so the refusal happens where the input
arrives and names the field.

Also index `steam_enrolment.user_id`. The primary key begins with the machine,
which answers what one host holds and nothing else, so neither of the two
things that read by user alone can use it: the cascade behind deleting a user,
and asking which hosts hold a token for one person. The table's migration has
not been released, so this is folded into it rather than following it with a
correction.

packages/core/migrations/meta/0012_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "5c6f5a6c-74ff-4b9d-95ac-bef2c2603273",
+  "id": "d519bc2f-25f8-46e1-b7df-67bf6b5a927a",
   "prevId": "6fdda454-c7ee-42c1-931b-fa595385aac0",
   "version": "7",
   "dialect": "postgresql",
@@ -1860,7 +1860,23 @@
           "notNull": false
         }
       },
-      "indexes": {},
+      "indexes": {
+        "steam_enrolment_user_idx": {
+          "name": "steam_enrolment_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
       "foreignKeys": {
         "steam_enrolment_machine_id_machine_id_fk": {
           "name": "steam_enrolment_machine_id_machine_id_fk",

packages/core/migrations/meta/_journal.json

@@ -89,7 +89,7 @@
     {
       "idx": 12,
       "version": "7",
-      "when": 1788690115352,
+      "when": 1788691753961,
       "tag": "0012_steam_enrolment_without_a_token",
       "breakpoints": true
     }