fix(auth): isolate unsafe account merge flow

[XiaoSeS]

What

• keep the three legacy account merge routes but make authenticated valid requests fail closed with one localized 503 Service Unavailable response
• remove the unsafe AccountMergeService, so the old verification-token and destructive migration path is no longer a callable Spring service
• replace the account settings merge form and token controls with an English/Chinese security notice
• preserve the legacy table and rows without completing or deleting requests
• add operator guidance and a detailed acceptance design for the future safe Account Merge implementation

Why

The legacy initiate route returned the secondary-account verification token to the already-authenticated primary-account session. That same session could verify and confirm the request without independently authenticating as the secondary account. The flow could then migrate bindings, API tokens, platform roles, namespace memberships, and local credentials.

This PR is the P0 containment change. It intentionally does not implement the future dual-reauthentication merge flow.

Closes #634
Parent: #628

How

AccountMergeController retains the published paths and request/response schemas for deployed-client compatibility, but no longer delegates to a mutation service. Valid authenticated requests terminate with error.auth.merge.temporarilyUnavailable. Invalid authentication or CSRF is still rejected by the existing security chain.

The legacy JPA entity, repository, schema, and rows remain available for forensics and a future explicit migration. The unsafe orchestration service and its success-path tests are removed. The replacement controller tests assert the stable 503 response and absence of proof/request data.

Testing

• AccountMergeControllerTest: 5 tests passed
• frontend full suite: 181 files / 618 tests passed
• pnpm typecheck: passed
• pnpm lint: passed
• backend package build: passed
  • ./mvnw -pl skillhub-app -am -DskipTests package
• full backend-app suite on this host requires -Dnet.bytebuddy.experimental=true because only Java 25 is installed and the repository's Byte Buddy version officially supports through Java 22
• after enabling that test-process-only compatibility switch, the suite reproduced the pre-existing ApiTokenAuthenticationFilterTest.shouldIgnoreNonBearerAuthorizationHeader global SecurityContextHolder order leak; that test passes alone (1/1) and is unrelated to this diff
• local staging was not started because the shared host already has a user-owned PostgreSQL service on the staging compose's fixed port 5432; this draft must be integrated into big-main and validated in the test environment

Impact

• intentional temporary removal of successful account merge behavior
• no database migration
• no route-path or OpenAPI schema removal
• no existing merge request is completed, deleted, or converted
• rollback to an older image would re-enable the unsafe implementation; operators must keep /api/v1/account/merge/* blocked if such a rollback is unavoidable
• this draft must not merge to main until big-main and test-environment validation are complete

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ XiaoSeS
❌ ylhu16

---

ylhu16 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[XiaoSeS]

Superseded by #639. This draft was created from the big-main integration branch and therefore included unrelated integration ancestry when compared with main. #639 contains the same P0 0C change as one clean commit on top of origin/main. No review should be performed on this superseded draft.