v0.87.0 — the operator is a person

A platform operator is no longer a second credential store.

platform_operators held an email and a bcrypt hash and nothing else. Everything that protects a sign-in on this platform lives on the SUBJECT — password policy, breached-password refusal, lockout, TOTP, passkeys, step-up, session revocation — and an operator had none of it. The widest reach in the product sat behind the weakest door, and it was weakest precisely because it was separate.

platform_operators.subject_id now points at an ordinary subject in the platform root, and verifyPassword() asks that subject. Account members already worked this way.

PlatformOperators::findBySubject() completes the change: with the operator unified onto the subject store, "is this session staff" is a question about the session a host already has — so a console can gate the platform pages as a permission instead of standing up a second sign-in beside the first. Suspended operators are excluded inside the lookup, because authority now rides an existing session and suspending an operator has never revoked their subject sessions.

Nothing breaks on upgrade: the column is nullable, the local hash remains the credential for an operator created before a platform root existed, and the subject attaches on that operator's next successful sign-in.

Full notes in CHANGELOG.md.