fix(sso): bind Microsoft sign-in to the IdP identity, not the email claim

SSO picked the local account by the email/preferred_username claim, which
Entra does not verify. Anyone able to present a matching email (another
tenant with a multi-tenant issuer, or an editable attribute) could sign in
as that user without a password.

- The first SSO login links the account to "<iss>|<oid>" (new unique
  column User.ssoSubject); afterwards only that identity signs in, and a
  matching email from another identity is refused.
- Multi-tenant issuers (common/organizations/consumers) disable SSO.
- Emails are compared case-insensitively and stored lower-case, so
  [email protected] and [email protected] can no longer be two accounts; the migration
  lower-cases existing emails where that does not collide.
- An admin changing a user's email clears the link.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/schema.prisma

@@ -88,6 +88,11 @@ model User {
   // nach einer Passwortaenderung nicht bis zu 15 Minuten weiter funktioniert.
   passwordChangedAt DateTime?
 
+  // Unveraenderliche Identitaet beim Identity Provider ("<iss>|<oid>"),
+  // gesetzt bei der ersten Microsoft-Anmeldung. Danach entscheidet nur sie,
+  // nicht mehr der (unverifizierte) E-Mail-Claim, welches Konto sich anmeldet.
+  ssoSubject String? @unique
+
   refreshTokens RefreshToken[]
 
   inspections           Inspection[]