fix(users): populate derived emails for bots and deletions

[markijbema]

Summary

• Populate normalized_email and email_domain whenever web and webhook-ingest bot users are created, using the same tested .internal domain derivation in both paths.
• Replace deleted users with unique deleted-<id>@deleted.invalid tombstones and retain corresponding derived email values without preserving the original address.
• Let the backfills repair historical deleted rows, including canonicalizing legacy deleted+<id>@deleted.invalid emails that collapse under plus-alias normalization.

Verification

• Not manually verified; this change affects persistence and admin backfill selection rather than an interactive flow.

Visual Changes

N/A

Reviewer Notes

• Deleted users now intentionally contribute only the synthetic deleted.invalid domain when domain aggregations include them.
• Existing active bot rows and legacy deletion tombstones can be repaired by running the admin backfills after deployment.
• Added regression coverage for .internal email-domain extraction and deletion tombstone/backfill behavior.
• Local pnpm validation was skipped after the repository formatting workflow repeatedly stalled in this sandbox; CI is used for automated validation.

[kilo-code-bot]

WARNING: normalized_email is set to the raw botEmail without calling normalizeEmail(), while the web-app bot creation path (bot-user-service.ts:58) consistently calls normalizeEmail(botEmail). Bot emails are already lowercase with no + aliases, so in practice the result is identical today — but the inconsistency could silently diverge if generateBotUserEmail ever produces mixed-case output. Consider passing through normalizeEmail(botEmail) here for parity.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The webhook-agent-ingest bot creation path sets normalized_email without calling normalizeEmail(), creating an inconsistency with the web-app bot creation path.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/webhook-agent-ingest/src/db/queries.ts	149	normalized_email: botEmail skips normalizeEmail() — inconsistent with web-app bot-user-service.ts:58 which calls normalizeEmail(botEmail)

Files Reviewed (7 files)

• apps/web/src/app/admin/api/backfills/email-domain/route.test.ts
• apps/web/src/app/admin/api/backfills/email-domain/route.ts
• apps/web/src/app/admin/api/backfills/normalized-email/route.test.ts
• apps/web/src/app/admin/api/backfills/normalized-email/route.ts
• apps/web/src/lib/bot-users/bot-user-service.ts
• apps/web/src/lib/email-domain.test.ts
• apps/web/src/lib/user/deleted-email.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts
• services/webhook-agent-ingest/src/db/queries.ts - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-4.6 · 1,016,940 tokens}

_{Review guidance: REVIEW.md from base branch main}