docs: add callout against using non-pks as fk references

apps/docs/pages/guides/auth/managing-user-data.mdx

@@ -34,6 +34,14 @@ Make sure to specify the `on delete cascade` clause when referencing `auth.users
 
 </Admonition>
 
+<Admonition type="caution">
+
+Only use primary keys as [foreign key references](https://www.postgresql.org/docs/current/tutorial-fk.html) to schemas and tables like `auth.users` which are managed by Supabase. 
+
+PostgreSQL lets you specify a foreign key reference to columns which are backed by a unique index (not necessarily primary keys). Be aware that **primary keys are guaranteed not to change.** Columns, indices, constraints or other database objects managed by Supabase **may change at any time** and you should be careful when referencing them directly.
+
+</Admonition>
+
 ## Deleting Users
 
 You may delete users directly or via the management console at Authentication > Users. Note that deleting a user from the `auth.users` table does not automatically sign out a user. As Supabase makes use of JSON Web Tokens (JWT), a user's JWT will remain "valid" until it has expired. Should you wish to immediately revoke access for a user, do considering making use of a Row Level Security policy as described below.