Stop requesting, storing, and mirroring WCA email addresses

[coder13]

Goal

Treat email as data Let’s Cube does not have: do not request it from the WCA, ingest it, retain it, mirror it, search it, expose it, log it, or use it for product behavior.

Current state

The client currently requests the WCA email OAuth scope, authentication copies profile.email into MongoDB, and the PostgreSQL user mirror contains an email column. Email is not needed for login, rooms, results, or the Friend System.

The WCA OAuth provider defines public as the default scope and email/dob as optional scopes, so Let’s Cube should request only the public identity it actually uses.

Acceptance criteria

• Change the OAuth authorization request to the minimum public scope; remove both unused email and dob scopes.
• Allowlist the WCA profile fields ingested at login and ignore email even if an older token/provider response contains it.
• Remove email writes from normal and test authentication, the MongoDB user model, PostgreSQL dual writes, API responses, fixtures, and documentation.
• Add an idempotent, observable purge that unsets every existing MongoDB user email and clears every PostgreSQL copy without printing values.
• Use a two-phase, rollback-aware database change: first stop writes and purge while any compatibility column is empty, then drop the field/column only after the supported rollback image also cannot repopulate it.
• Define the privacy cutover so production can never roll back to an image that resumes collecting email.
• Ensure user discovery accepts only normalized username and explicitly visible WCA ID inputs; email-like queries must not match users or reveal whether an address exists.
• Add tests proving email is absent after login, user serialization, dual-write payloads, migration reruns, social search, logs, and metrics.
• Update data/privacy/operations documentation with the invariant: Let’s Cube does not retain WCA email addresses.

Verification

• Inspect a newly authenticated MongoDB user and PostgreSQL mirror: no email value.
• Run the purge twice and confirm the second pass changes zero records.
• Search for a known historical email through every user/social endpoint and receive no match or existence signal.
• Confirm WCA consent requests public identity only.

Dependencies

Complete before enabling #82 or any Friend System discovery endpoint.