feat(identity): identity layer foundation (Phase 1)

[bokelley]

Summary

Phase 1 of decoupling person from WorkOS user so that "linked emails" can stop being a local-only fiction.

A WorkOS user is one credential bundle for one email — that's WorkOS's data model and we won't fight it. An identity is the person, and may back multiple WorkOS users (one per email). Today every user is its own singleton identity. Phase 2 will rewrite mergeUsers to bind multiple WorkOS users to one identity instead of deleting the secondary user, so that each linked email is a real WorkOS user that actually works for sign-in and our local DB becomes a truthful cache of WorkOS state.

This PR is no functional change. No app code reads identityId yet.

What's in here

• Migration 460_identities.sql: adds identities and identity_workos_users, backfills 1:1 from users, installs an AFTER INSERT trigger that auto-creates a singleton identity for any new user. The trigger fires on INSERT only — ON CONFLICT DO UPDATE upserts route through AFTER UPDATE, which is correct (existing users already have an identity).
• WorkOSUser.identityId?: string on the type (server/src/types.ts).
• Auth middleware resolves identityId from identity_workos_users and attaches it to req.user for real users (skipped for synthetic admin / WorkOS-API-key users). Resolved once per session miss; cached. JWT and dev-mode paths also resolve.

Why now

Escalation #298 (Ahmed Karim, Kyber1) surfaced that today's mergeUsers deletes the secondary WorkOS user but only records the email locally. The "Linked emails" UI implies you can sign in with any of them — you can't, because WorkOS doesn't know about the alias. The right fix is to stop deleting WorkOS users on merge; instead, bind both to one identity. That requires the identity layer to exist first.

Test plan

• Migration runs cleanly (verified locally; backfill is set-based via a transient column).
• Backfill invariant: every existing user has exactly one identity_workos_users row marked primary.
• Trigger creates a singleton identity for newly inserted users.
• ON CONFLICT DO UPDATE upsert does not double-fire the trigger.
• Partial unique index rejects a second primary binding on the same identity.
• DELETE FROM users cascades to remove the binding.
• set-primary-email.test.ts and membership-webhook.test.ts still pass (68/68) — no regression in adjacent flows.
• npx tsc --noEmit clean.

Phase 2 preview (separate PR)

• Rewrite mergeUsers → bind both WorkOS users to one identity, no deletion.
• "Linked emails" UI shows real WorkOS users, each working for sign-in.
• Critical tables (organization_memberships, learner_progress, certification_attempts, person_relationships) start dual-writing identity_id.
• Admin tool: "create new WorkOS user for <email>, bind to existing identity" — fixes the Ahmed class of escalation directly.

🤖 Generated with Claude Code