Fix OIDC identity link ownership - #42

Outcome

• persist login credentials against the explicitly verified account and verify ownership after creation
• exclude internal service accounts from identity-link login resolution
• narrowly repair legacy links owned by the built-in token account only when provider, type, external ID, digest, and target identity all match
• apply the same ownership invariant to identity-proof and provider-switch credentials

Verification

• source release gate: PASS
• Maven reactor through auth-logic: 38/38 modules PASS
• auth-logic: 93 tests, 0 failures/errors
• new ownership regression cases: 4/4 PASS

Runtime repeated-login and permission-matrix acceptance will run against the Server image that consumes this release before production use.