fix(auth): provision global membership on user approval

[XiaoSeS]

What

• provision the built-in @global MEMBER membership whenever an administrator activates a pending or disabled account
• keep account status and membership provisioning in one transaction
• preserve completed approval on later OAuth logins when access policy still returns PENDING_APPROVAL
• reject reactivation of MERGED and system accounts
• add deployed admin activation smoke coverage and update auth/domain documentation

Why

A pending account could be approved without receiving the namespace membership required by normal authenticated workflows. In addition, the OAuth flow reevaluated PENDING_APPROVAL before resolving an existing binding, which could send an already approved user back to the pending page.

Closes #632
Parent: #628

How

AdminUserAppService now delegates membership provisioning to the existing idempotent GlobalNamespaceMembershipService inside the status-update transaction. The OAuth flow uses PENDING only as the initial status when resolving a PENDING_APPROVAL decision, so the stored account status remains authoritative after an administrator acts.

Testing

• Java 21 targeted regression: 43 tests passed
  • AdminUserAppServiceTest
  • AdminUserApprovalIntegrationTest
  • UserManagementControllerTest
  • GlobalNamespaceMembershipServiceTest
  • OAuthLoginFlowServiceTest
  • IdentityBindingServiceTest
• bash -n scripts/smoke-test.sh
• Java 21 backend package build passed
• backend Docker image build passed (skillhub-server:identity-p0b)
• full backend-app suite still reproduces the pre-existing ApiTokenAuthenticationFilterTest.shouldIgnoreNonBearerAuthorizationHeader global SecurityContextHolder leak from origin/main; the failing test passes alone and is unrelated to this diff
• full local staging was not started because the shared host already has a user-owned PostgreSQL process bound to the staging compose's fixed port 5432; the new HTTP smoke path will be run from the big-main test deployment

Impact

• no schema or API contract change
• no frontend change
• compatible with existing ACTIVE and DISABLED account management
• this draft must be integrated into big-main and validated in the test environment before it is considered for main

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

ylhu16 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

ylhu16 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.