Deduplicate verified auth accounts by email

[DerpcatMusic]

Summary

• deduplicate verified same-email auth accounts before provider linking so Google and email sign-in converge on one Queue user
• add safe migration entrypoints for existing verified duplicate emails and skip mixed-role or unverified account sets
• merge duplicate instructor or studio references and cover the new trust model with contract tests

Validation

• bun test "tests/contracts/auth-dedupe.contract.test.ts" "tests/contracts/backend-hardening.contract.test.ts"
• bun run typecheck