fix(identity): link an email-optional identity to a phone-only user

[hamodywe]

What

Linking an email-optional identity (for example an OIDC provider whose claim
carries no email) to a confirmed phone-only user currently fails with
422 email_not_confirmed, even though there is no email to confirm.

Fixes #2640.

Why it happens

In linkIdentityToUser (internal/api/identity.go), when the target user has
no primary email the code does:

if targetUser.GetEmail() == "" {
    targetUser.UpdateUserEmailFromIdentities(tx, autoconfirm) // may leave email empty
    if !userData.Metadata.EmailVerified {
        a.sendConfirmation(...)                 // <- sends a confirmation for a non-existent email
        return ..., ErrorCodeEmailNotConfirmed  // <- 422 to the caller
    }
    ...
}

UpdateUserEmailFromIdentities picks the highest-ranked identity's email, and an
email-optional identity contributes none — so the primary email is still empty
after the call. Because the OIDC claim also has email_verified = false, the
!EmailVerified branch runs and a confirmation email is "sent" for an address
that does not exist, and the link is rejected with email_not_confirmed.

#634 added support for providers without an email, but this linking path still
assumes an unverified email is always present.

The fix

Only run the email-confirmation logic when an email is actually present after
UpdateUserEmailFromIdentities:

if targetUser.GetEmail() != "" {
    if !userData.Metadata.EmailVerified {
        a.sendConfirmation(...)
        return ..., ErrorCodeEmailNotConfirmed
    }
    targetUser.Confirm(tx)
}

The anonymous→permanent transition stays outside that guard, so an anonymous
user that links a no-email identity is still de-anonymized. Behaviour is
unchanged whenever the linked identity does carry an email:

linked identity	before	after
verified email	user email set + confirmed	unchanged
unverified email	email_not_confirmed (confirmation sent)	unchanged
no email (email-optional)	email_not_confirmed (spurious)	linked, email stays empty

Tests

TestLinkIdentityToUserEmailOptional in internal/api/identity_test.go, two sub-cases:

1. no email in the identity links without confirmation — the regression:
   a confirmed phone-only user links an email-less OIDC identity; asserts success,
   the phone is preserved, the email stays empty, and the identity is created.
2. unverified email in the identity still requires confirmation — a control
   case proving the fix does not over-broaden: an identity that does carry an
   unverified email still returns email_not_confirmed.

Verification

• go vet ./internal/api/ clean, go test -c ./internal/api/ (compiles the full
  suite incl. these tests) clean, gofmt clean.
• Local run gap, disclosed honestly: internal/api tests are Postgres-backed
  (-p 1 -race) and this dev machine has no Docker/Postgres/cgo, so I could not
  execute the suite locally. The tests are written to the suite's existing
  patterns and are intended to run on CI's Postgres matrix. Expected result there:
  sub-case 1 passes with the fix and fails (422 email_not_confirmed) if
  identity.go is reverted — i.e. genuine regression coverage — and sub-case 2
  passes unchanged.
• The control sub-case deliberately uses an email-less (anonymous) user rather
  than a phone-only one, because a phone-only user's empty-email phone identity
  makes UpdateUserEmailFromIdentities keep the empty email (its "an identity
  already uses this email" early-return matches "" == ""), so no email is
  promoted and there would be nothing to confirm — which is exactly the mechanism
  behind the bug this PR fixes.

---