Phase 3A: User Identity + OAuth Storage
Foundation for Gmail/Drive integration. Adds users, oauth_tokens, gmail_sync_state, processed_emails tables; ALTERs pipeline_jobs for multi-tenant columns; ships AES-GCM 256 helpers and store CRUD for users and OAuth tokens. No Google API code yet — that's Phase 3B+.