fix(sso): bind Microsoft sign-in to the IdP identity, not the email claim

SSO picked the local account by the email/preferred_username claim, which
Entra does not verify. Anyone able to present a matching email (another
tenant with a multi-tenant issuer, or an editable attribute) could sign in
as that user without a password.

- The first SSO login links the account to "<iss>|<oid>" (new unique
  column User.ssoSubject); afterwards only that identity signs in, and a
  matching email from another identity is refused.
- Multi-tenant issuers (common/organizations/consumers) disable SSO.
- Emails are compared case-insensitively and stored lower-case, so
  [email protected] and [email protected] can no longer be two accounts; the migration
  lower-cases existing emails where that does not collide.
- An admin changing a user's email clears the link.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/profile/profile.service.ts

@@ -69,8 +69,8 @@ export class ProfileService {
           'Aktuelles Passwort erforderlich, um die E-Mail-Adresse zu ändern',
         );
       }
-      const existing = await this.prisma.user.findUnique({
-        where: { email: dto.email },
+      const existing = await this.prisma.user.findFirst({
+        where: { email: { equals: dto.email, mode: 'insensitive' } },
       });
       if (existing) {
         throw new ConflictException('Email already in use');