Fix non-deterministic query ordering after PostgreSQL migration and strengthen PK lookup semantics

Author: tjementum

.claude/rules/backend/repositories.md

@@ -32,6 +32,7 @@ Guidelines for implementing DDD repositories in the backend, including structure
 14. Never do N+1 queries
 15. Don't register repositories in DI—SharedKernel registers them automatically
 16. Don't add DbSets to DbContext—RepositoryBase handles this automatically
+17. Add `.OrderBy(e => e.Id)` when caller depends on order (`[0]`, `.First()`, pagination)—ULIDs are chronological
 
 ## Examples
 

application/account/Core/Features/Authentication/Domain/SessionRepository.cs

@@ -44,7 +44,7 @@ public sealed class SessionRepository(AccountDbContext accountDbContext, IServic
 {
     public async Task<Session?> GetByIdUnfilteredAsync(SessionId sessionId, CancellationToken cancellationToken)
     {
-        return await DbSet.IgnoreQueryFilters().FirstOrDefaultAsync(s => s.Id == sessionId, cancellationToken);
+        return await DbSet.IgnoreQueryFilters().SingleOrDefaultAsync(s => s.Id == sessionId, cancellationToken);
     }
 
     /// <summary>

application/account/Core/Features/Tenants/Domain/TenantRepository.cs

@@ -41,6 +41,6 @@ public async Task<Tenant[]> GetByIdsAsync(TenantId[] ids, CancellationToken canc
     /// </summary>
     public async Task<Tenant?> GetByIdUnfilteredAsync(TenantId id, CancellationToken cancellationToken)
     {
-        return await DbSet.IgnoreQueryFilters().FirstOrDefaultAsync(t => t.Id == id, cancellationToken);
+        return await DbSet.IgnoreQueryFilters().SingleOrDefaultAsync(t => t.Id == id, cancellationToken);
     }
 }

application/account/Core/Features/Users/Domain/UserRepository.cs

@@ -256,6 +256,7 @@ public async Task<User[]> GetUsersByEmailUnfilteredAsync(string email, Cancellat
         return await DbSet
             .IgnoreQueryFilters([QueryFilterNames.Tenant])
             .Where(u => u.Email == email.ToLowerInvariant())
+            .OrderBy(u => u.Id)
             .ToArrayAsync(cancellationToken);
     }