Stop collecting and retaining WCA email

[coder13]

Summary

• request only the WCA public OAuth scope and allowlist the provider fields accepted at login
• remove email from test auth, the MongoDB schema, serialized users, and PostgreSQL dual-write payloads
• add an idempotent, value-free MongoDB/PostgreSQL purge with post-update verification
• enforce a persistent privacy rollback floor in the deploy script and document the two-phase production cutover
• retain app.users.email only as an always-null compatibility column until every supported rollback image can tolerate its removal

Closes #191

Privacy cutover ordering

1. Deploy this release to both socket and API/static services and verify health, public-only WCA consent, and login.
2. Record the healthy commit in .privacy-email-cutover; subsequent deploys fail closed when a candidate does not descend from that commit.
3. Run the purge from the new image twice. The second run must report zero matched, modified, cleared, and remaining records.
4. Replace pre-cutover backups with a verified post-cutover backup and securely remove historical copies.
5. In a later release, remove application references to the compatibility column, advance the rollback floor, and only then drop the column.

The purge intentionally is not a pre-deploy Prisma migration: migrations run before application health is established, which could otherwise allow automatic rollback to an image that resumes collection.

Validation

• yarn lint
• yarn test (18 server suites / 85 tests, 15 client suites / 83 tests, 1 scramble suite / 22 tests)
• yarn build
• yarn workspace letscube-server postgres:schema:validate
• focused auth, user serialization, dual-write, OAuth scope, and purge tests
• scripts/test-deploy.sh, including rejection of a pre-cutover commit
• git diff --check origin/master...HEAD

Integration notes

• No social discovery endpoint exists on master. Issue Add privacy-safe cuber discovery and public profiles #82 must enforce the documented rule that discovery accepts only normalized username and explicitly visible WCA ID formats, and that email-like input produces no match or existence signal.
• The compatibility column drop is deliberately deferred; doing it in this PR would violate the current automatic rollback contract.