Several provider accounts can open one user: an identities block with
Postgres/Neon and in-memory stores (auth_identities with a unique
provider+subject index), GET/DELETE /auth/identities that never removes the
last way in, and linkCallbackIdentity for onLinkIdentity, which throws
AuthIdentityConflictError so onLinkIdentityConflict runs.

Passkeys get names (from the registration request or the provider's AAGUID)
and owner-only list, rename and delete routes; the client gains rename, a
working list, a named registration and runPasskeyAuthentication.

Sessions record their sign-in method and User-Agent, and the session list
returns them with a coarse browser/OS. Release 0.92.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>