feat(auth): implement secure account merge intents and atomic migration

[XiaoSeS]

Parent

• feat(auth): build a unified identity federation architecture #628
• Follow-up to the fail-closed isolation in fix(auth): disable unsafe legacy account merge flow #634
• Depends on the unified identity core, Binding V2, Provider Registry, and explicit Identity Link (feat(auth): add explicit identity link and safe unlink flow #655)

Problem

The legacy account merge flow cannot prove independent control of both accounts and therefore remains disabled. Implement the safe Account Merge flow defined in docs/22-secure-account-merge-acceptance-design.md without reopening the legacy token-based endpoints.

Scope

• Server-side, short-lived primary fresh-reauthentication proof bound to the current Web Session.
• One-time Merge Intent with TTL, session nonce hash, optimistic/pessimistic concurrency control, and stable reason codes.
• Independent secondary authentication through local password, Browser Provider, or Credential Provider; request bodies must not accept secondary userId, email, username-as-identity, or provider:subject as proof.
• Real-time conflict preview with preview_version and server-side digest; confirm recomputes the digest and fails stale previews closed.
• Atomic PostgreSQL migration policy for active Identity Bindings, local credentials, Namespace memberships, Skill ownership, current social state, profile/transient state, and historical references.
• Block non-default platform-role escalation and new Namespace OWNER acquisition.
• Revoke (do not migrate) every active secondary API Token.
• Mark the secondary account MERGED with merged_to_user_id in the same transaction.
• Stable per-request account-state guard plus retryable Redis Session revocation task and metrics.
• New flow disabled by default; legacy initiate/verify/confirm endpoints continue returning 503.
• Account settings UI, operator documentation, OpenAPI contract, audit events, and low-cardinality metrics.

Required migration inventory

Before implementation is considered complete, classify every database/string/JSON reference to a platform user as one of:

1. current ownership to migrate;
2. current authorization to migrate/revoke;
3. historical fact to preserve on the secondary user;
4. derived/transient data to rebuild, migrate, invalidate, or delete.

Any unclassified user reference blocks release.

Acceptance

• Primary and secondary proofs are two independent authentication actions and never appear in URL, response, logs, or audit detail.
• Same-account, system-account, non-ACTIVE, expired, replayed, session-mismatched, conflicting, and concurrent confirmations fail closed.
• Two concurrent confirms yield exactly one commit.
• Injected failure at each migration stage rolls back all PostgreSQL changes.
• Secondary Web Sessions are rejected immediately after commit even if Redis deletion is delayed; deletion retries are observable.
• Secondary API Tokens return 401 after commit; primary tokens remain valid.
• PostgreSQL 16 and Redis integration tests, rolling-upgrade checks, and Hong Kong test-machine deployment all pass on the exact big-main SHA.
• No server reboot; isolated test resources and images/caches are cleaned after validation.

Delivery

Target a dedicated PR at big-main. Do not merge directly to main.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p2 (3.2/5)
• Effort: effort/l (4/5)
• Confidence: 1/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (review, namespace, auth).
• Contains urgency signals (fails, failure, cannot).
• Text suggests a bounded change (docs, documentation, link).
• Issue is missing key context (problem, proposed solution).

High-Risk Signals

• Mentions sensitive areas (auth, migration, account merge).

Missing Info

• Please add problem.
• Please add proposed solution.

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: problem, proposed solution.

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p2 (3.2/5)
• 修复投入: effort/l (4/5)
• 信息完整度: 1/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（review, namespace, auth）
• 包含紧急信号（fails, failure, cannot）
• 文本显示改动范围较可控（docs, documentation, link）
• 缺少关键上下文（problem, proposed solution）

高风险信号

• 提到敏感区域（auth, migration, account merge）

缺失信息

• 请补充 problem.
• 请补充 proposed solution.

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.