feat(oidc): permit auto/manual oidc account link/unlink

link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin

src/domain/entities/user.rs

@@ -355,7 +355,8 @@ impl User {
         // only fires on inconsistent partial state.
         if federation_issuer.is_some() != federation_subject.is_some() {
             return Err(UserError::ValidationError(
-                "federation_issuer and federation_subject must both be set or both be None".to_string(),
+                "federation_issuer and federation_subject must both be set or both be None"
+                    .to_string(),
             ));
         }
         // If either field is set, federation_kind MUST also be set — the