fix(auth): converge concurrent identity binding

[XiaoSeS]

What

Closes #613.

Concurrent first-time OAuth callbacks now converge on the identity binding committed by the winning transaction instead of returning HTTP 500.

Design

• Execute the initial binding attempt in a REQUIRES_NEW transaction.
• Force the unique identity coordinate with saveAndFlush before membership or activation events.
• On a unique-key race, let the failed transaction roll back and resolve the winning binding in a second REQUIRES_NEW transaction.
• Re-throw unrelated integrity failures when no winning binding exists.
• Preserve pending, disabled, merged, and system-account outcomes without logging the OAuth subject.

Tests

• Winning principal convergence.
• Pending-user convergence.
• Unrelated integrity failure propagation.
• Existing active, pending, disabled, merged, system-account, verified-email, membership, event, and role behavior.

Signed-off-by: XiaoSeS 87064762+XiaoSeS@users.noreply.github.com