store: add users table and user_id scoping to migrations

Schema-only step toward per-user profile isolation: profile/workout_kinds/
sync_state are rebuilt to drop their singleton constraints, activities/
sync_runs gain a nullable user_id column. Store methods are scoped in
later tasks.

backend/internal/store/store_test.go

@@ -195,3 +195,39 @@ func TestReplaceLapsIsIdempotent(t *testing.T) {
 		t.Fatalf("expected 1 lap after replace, got %d", len(got))
 	}
 }
+
+func TestUsersAndOwnershipSchema_AppliesCleanly(t *testing.T) {
+	db := openTestDB(t)
+	ctx := context.Background()
+
+	// A fresh DB has no legacy singleton rows, so every user_id column
+	// should already be backfilled to nothing (fresh install, no rows at
+	// all yet in these tables besides the migration-seeded workout_kinds --
+	// which do have NULL user_id until a real user is provisioned).
+	var nullableCount int
+	if err := db.QueryRowContext(ctx, `SELECT COUNT(*) FROM workout_kinds WHERE user_id IS NULL`).Scan(&nullableCount); err != nil {
+		t.Fatalf("count workout_kinds: %v", err)
+	}
+	if nullableCount != 8 {
+		t.Fatalf("expected 8 migration-seeded workout_kinds with NULL user_id on a fresh DB, got %d", nullableCount)
+	}
+
+	// UNIQUE(user_id, name) allows the same name across two different users.
+	if _, err := db.ExecContext(ctx, `INSERT INTO users (oidc_sub, display_name) VALUES ('sub-a', 'A'), ('sub-b', 'B')`); err != nil {
+		t.Fatalf("insert users: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `
+		INSERT INTO workout_kinds (user_id, name, rule_json)
+		VALUES ((SELECT id FROM users WHERE oidc_sub='sub-a'), 'Custom Kind', '{}'),
+		       ((SELECT id FROM users WHERE oidc_sub='sub-b'), 'Custom Kind', '{}')`); err != nil {
+		t.Fatalf("expected same workout_kind name to be allowed across two different users, got: %v", err)
+	}
+
+	// profile/sync_state UNIQUE(user_id) still rejects a genuine duplicate.
+	if _, err := db.ExecContext(ctx, `INSERT INTO profile (user_id) VALUES ((SELECT id FROM users WHERE oidc_sub='sub-a'))`); err != nil {
+		t.Fatalf("insert profile for sub-a: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `INSERT INTO profile (user_id) VALUES ((SELECT id FROM users WHERE oidc_sub='sub-a'))`); err == nil {
+		t.Fatal("expected a second profile row for the same user_id to violate UNIQUE(user_id)")
+	}
+}