0rbit.life users are identified by rows in orbit_app_memberships. SmartSongbook / shared Auth users are users without a 0rbit role. Email changes and direct password setting require a server-side Supabase Auth admin endpoint.