feat(oidc): permit auto/manual oidc account link/unlink

link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin

tests/oidc/run.sh

@@ -179,10 +179,13 @@ wait_for_http "$base_url/ready" 120
 log "Server is ready."
 
 # ── 5. Run the OIDC Hurl suite ─────────────────────────────────────────────
+# Order matters: oidc.hurl bootstraps the admin and JIT-provisions the
+# `oidc_user` federated principal that link_unlink.hurl then reuses.
 log "Running OIDC Hurl tests..."
 hurl --variables-file "$OIDC_DIR/test.env" \
      --file-root "$REPO_ROOT/tests" \
      --test --jobs 1 \
-     "$OIDC_DIR/oidc.hurl"
+     "$OIDC_DIR/oidc.hurl" \
+     "$OIDC_DIR/link_unlink.hurl"
 
 log "OIDC tests passed."