feat: dry-run legacy identity audit report

[felixgateru]

Problem

• pre-Fix session self-profile updates for global human identities #109 identity state may already be inconsistent (unverified emails, drifted credentials, stale OAuth links), with no way to see the scope before attempting any recovery.

Depends on #115: pendingTokens.emailChange queries the email_change_tokens table introduced there. This diff includes #115's commits until it merges.

Fix

Four read-only, platform-admin-only GraphQL queries, each paginated and filterable by entityId:

• legacyUnverifiedEmails — live entity_emails rows with verified_at IS NULL
• legacyCredentialIdentifierMismatches — active password credentials whose identifier disagrees with (or is missing) the canonical email
• legacyOauthEmailMismatches — OAuth identities whose claimed email doesn't match an active, verified canonical email
• legacyAttributesEmailMismatches — human entities whose legacy attributes.email disagrees with the canonical row

Every row carries pendingTokens — counts only, never values — so an operator can see a self-service fix may already be in flight before reaching for manual recovery. Nothing here mutates a row.

Tests

• 7 new tests + 24 existing admin-query tests, no regressions
• caught and fixed a real edge case along the way: {"email": null} passes the JSONB key-exists check but breaks non-optional string extraction — now excluded explicitly

Part of #110 (workstream B, report half; remediation tooling and the operator runbook remain a separate PR).