feat(identity): rewrite mergeUsers to bind, don't delete (Phase 2a)

[bokelley]

Summary

Phase 2a of the identity layer. Confirming an "I have two accounts" link no longer destroys the secondary WorkOS user — both linked emails stay live as real sign-in credentials, both bound to one identity. Reads still work because we still move data to the primary; the auth middleware id-swaps non-primary logins to the canonical user.

Builds on Phase 1 (#3711, merged). Phase 2b will be the admin "create + bind" tool that finally unblocks Ahmed; this PR is the prerequisite that makes the binding actually useful (without id-swap, a non-primary login would land in an empty workspace).

What changes

server/src/db/user-merge-db.ts

• Drop the WorkOS deleteUser call and the workos parameter (no longer needed).
• After moving data, re-point the secondary's identity_workos_users row to the primary's identity, marked is_primary = FALSE.
• Drop the secondary's now-orphan singleton identity row.
• Drop workos_user_deleted and warnings from UserMergeSummary (deletion no longer happens).

server/src/middleware/auth.ts

• Extend attachIdentityId to also resolve the identity's primary workos_user_id. When the authenticated user is a non-primary binding, swap req.user.id to the canonical and stash the original on req.user.authWorkosUserId.

server/src/types.ts

• New WorkOSUser.authWorkosUserId for code that needs the actual auth user (WorkOS API calls, audit logs).
• Doc comment on id clarifies the new contract: "canonical workos_user_id for app-state queries."

server/src/routes/account-linking.ts

• Verify-email-link confirmation page: "signing in with either email leads to the same workspace" (was: "this cannot be undone").
• Drop the getWorkos() arg to mergeUsers.

server/src/http.ts

• Drop the workos! arg from the Google-alias-merge call site.

Test plan

• New: merge-bind-not-delete.test.ts (5 tests) — secondary WorkOS user stays alive; both bindings point at one identity; secondary's binding is non-primary; orphan identity is dropped; org_memberships still move to primary; audit row written.
• Phase 1 tests still pass (identity-layer.test.ts, 6 tests).
• Adjacent: set-primary-email.test.ts (8), membership-webhook.test.ts (60). 79/79 across all auth/identity/merge.
• tsc --noEmit clean.
• Pre-existing flakes in registry-reader-baseline / brand-properties tests confirmed to also fail on main — not introduced here.

Phase plan recap

• ✅ Phase 1 (feat(identity): identity layer foundation (Phase 1) #3711): identity layer foundation
• 👉 Phase 2a (this PR): mergeUsers binds, doesn't delete
• ⏳ Phase 2b: admin "create + bind" tool — unblocks Ahmed directly
• ⏳ Phase 2c: linked-emails UI reads from identity_workos_users (tells the truth); drop user_email_aliases
• ⏳ Phase 3: identity_id columns on hot tables (eventual cleanup of the id-swap)

🤖 Generated with Claude Code