Make the login case-insensitive and keep non-admins off the user list

The login compared the email case-sensitively, although emails are stored
lowercased, so "Fritz@finn.st" could not log in. After changing the
password without ?return=detail, non-admins were redirected to the user
list, which is a 404 for them; they now go back to their detail page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/db/users.py

@@ -29,7 +29,7 @@ base_user_query = (
 
 @with_cursor
 def get_user_by_email(cur, email):
-    return get_user(cur, f"{base_user_query} WHERE e.email=%s", email)
+    return get_user(cur, f"{base_user_query} WHERE e.email=lower(%s)", email)
 
 
 @with_cursor

max/routes/base_user_views.py

@@ -24,7 +24,8 @@ class FetchUserTemplateGetView(FetchUserMixin, BaseTemplateGetView):
 
 class BackToUsersMixin(ReturnToMixin):
     def get_back_text_and_url(self):
-        if self.get_return_to() == RETURN_DETAIL:
+        # Non-admins cannot access the user list
+        if self.get_return_to() == RETURN_DETAIL or not self.auth_user.is_admin:
             return self.user.email, url_for("user-detail", user_id=self.user.id)
         else:
             return t("User list"), url_for("user-list")