stores registered accounts: - `id` (primary key) - `username` (unique, 3-30 characters) - `email` (unique) - `hashed_password` - `avatar_url` (optional) - `created_at`