In index.js, POST /patients route calls createPatient(req.body, req.user). When config.featureFlags.NEW_AUTH is true, auth.js sets req.user = { id: decoded.sub } (no email), but createPatient in db.js expects user.email. This causes a crash or undefined email in the new patient object, only breaking the POST path when the flag is enabled.
