fix(auth): enforce trusted external identity attributes

[XiaoSeS]

What

• require verified email assurance for EMAIL_DOMAIN access
• prevent unverified external email from populating or overwriting the platform email
• derive GitHub email assurance only from a verified entry returned by /user/emails
• reject PENDING, DISABLED, MERGED, and system accounts before profile updates or role loading
• map merged/system-account OAuth failures to the access-denied flow
• document the account-state and no-implicit-email-merge boundaries

Why

Closes #629. This is PR 0A from #628 and establishes the immediate safety invariants before the unified identity core is introduced.

How

The existing OAuth claims contract remains compatible. The binding service now gates trusted profile updates on emailVerified and applies an account-state guard before mutation. No schema or public API changes are introduced.

Testing

Java 21 container:

• focused auth regression: 43 tests passed, 0 failed
• full skillhub-auth reactor run: 130/131 tests passed
• the remaining failure is an existing order-dependent SecurityContextHolder leak: OAuth2LoginHandlersTest leaves a principal that ApiTokenAuthenticationFilterTest.shouldIgnoreNonBearerAuthorizationHeader observes; the same failure was reproduced on an untouched origin/main
• ApiTokenAuthenticationFilterTest passes when run independently
• git diff origin/main...HEAD --check

Test-environment deployment is intentionally pending. This PR remains draft until it is integrated into big-main and the relevant login regressions are validated.

Impact

• no database migration
• no OpenAPI or frontend type change
• existing verified-email login behavior remains unchanged
• unverified email can no longer grant domain-based access or overwrite trusted profile email
• merged and system accounts can no longer obtain an interactive OAuth session

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

ylhu16 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.