feat(aad-aws-sync): include UserId in query response

src/SelfService/Infrastructure/Api/System/IAadAwsSyncCapabilityQuery.cs

@@ -19,6 +19,11 @@ public class CapabilityDto
 public class MemberDto
 {
     public required string Email { get; set; }
+
+    // The member's identifier. For regular users this is their UPN, which lets
+    // aad-aws-sync look the user up in Azure AD directly instead of guessing via
+    // email — correct even when the user's UPN differs from their email address.
+    public required string UserId { get; set; }
 }
 
 public class ContextDto

src/SelfService/Infrastructure/Persistence/Queries/AadAwsSyncCapabilityQuery.cs

@@ -37,6 +37,9 @@ public async Task<IEnumerable<CapabilityDto>> GetCapabilities()
                         // Azure object id, so resolve the (synthetic) email from the Member record.
                         // Fall back to UserId for memberships without a matching Member row.
                         Email = emailByUserId.GetValueOrDefault(member.UserId, member.UserId),
+                        // UserId is the authoritative identifier (the UPN for regular users);
+                        // aad-aws-sync uses it to resolve the user in Azure AD directly.
+                        UserId = member.UserId.ToString(),
                     })
                     .ToArray(),
                 Contexts = awsAccounts