feat(auth): add profile synchronization and provisioning policy

[XiaoSeS]

Context

Follow-up to #628, #640, and the Binding V2 rollout. External login needs explicit ownership for profile fields and a provider-scoped provisioning decision instead of overwriting local/admin-maintained data.

Authoritative design: docs/21-unified-identity-federation-design.md, PR 3.

Scope

• Persist profile field source and assurance metadata.
• Add AUTO, APPROVAL, and EXISTING_BINDING_ONLY provisioning modes.
• Add per-field synchronization policies.
• Return a non-enumerating LINK_REQUIRED reason on verified-email collision without auto-binding.
• Keep PENDING approval idempotent and add @global membership on approval.
• Add audit records and bounded-cardinality login metrics.

Acceptance

• User/admin-maintained profile values are not overwritten by default.
• PENDING approve/reject/repeat-login behavior is transactional and deterministic.
• Email collision creates neither an account nor a binding and returns no account identifier or link token.
• Transaction failure leaves no orphan account, binding, subject, or profile source.
• Real PostgreSQL integration tests and full backend regression pass.
• Validate through big-main; do not merge directly to main.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p1 (3.7/5)
• Effort: effort/m (3/5)
• Confidence: 2/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (auth, login, token).
• Contains urgency signals (failure, regression).
• Text suggests a bounded change (text, docs, link).

High-Risk Signals

• Mentions sensitive areas (auth).

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: .

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p1 (3.7/5)
• 修复投入: effort/m (3/5)
• 信息完整度: 2/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（auth, login, token）
• 包含紧急信号（failure, regression）
• 文本显示改动范围较可控（text, docs, link）

高风险信号

• 提到敏感区域（auth）

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流

[XiaoSeS]

进度更新：实现 PR #651 与迁移兼容修复 PR #653 已合入 big-main，尚未进入 main。

已完成的验证：

• 完整后端回归：693 tests，0 failures / 0 errors
• PostgreSQL Profile Provisioning：8/8
• 管理员审批：5/5
• Binding V2 PostgreSQL：3/3
• fix(db): resolve identity migration version collision #653 完整 CI、真实服务 E2E、DCO、CLA 全部通过
• 从含既有 V44 的 PostgreSQL 16 数据库副本升级到 V48 成功，核心记录数保持一致
• big-main 精确 revision 镜像已部署到共享测试环境，数据库、Redis、Web、Scanner 均保持健康

该 Issue 暂时保持 OPEN，待 big-main 统一验收并提升到 main 后再关闭。

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.