Phoenix Auth Customization

RULES — Follow these with no exceptions

1. Never modify generated auth migrations — create separate migrations for custom fields; generated migrations are tested and correct
2. Update registration_changeset to cast and validate new fields — don't create a separate changeset for initial registration
3. Update test fixtures when adding required fields — missing fixture fields cause cryptic test failures across the entire test suite
4. Confirm users in test fixtures for password-based auth — set confirmed_at: DateTime.utc_now(:second) or tests requiring authenticated users will fail
5. Update both the registration form AND the save/2 handler — the form must send the field, and the handler must pass it to the context
6. Use unique_constraint + database unique index for uniqueness — never validate uniqueness in application code alone

Running phx.gen.auth

Start with the generator, then extend. Never hand-roll auth.