feat(auth): merge mobile+email logins into one account via BizGaze person-id (#2)

Provisioning now keys the Biz Connect account on bz.bizgazeUserId (the same
value whether the person signs in with email or mobile) instead of the typed
identifier, so both logins resolve to a single contact. Legacy rows get the
person-id stamped on next login; an existing duplicate created under the same
identifier is folded in via a transactional users.mergeInto() that reassigns
all messages/memberships/reactions/votes/favorites/ownership to the survivor.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/db.js

@@ -218,6 +218,11 @@ try { db.exec('ALTER TABLE messages ADD COLUMN msg_type TEXT'); } catch (e) { /*
 try { db.exec('ALTER TABLE messages ADD COLUMN deleted INTEGER NOT NULL DEFAULT 0'); } catch (e) { /* exists */ }
 // User-set presence status: 'active' | 'away' | 'onleave'. ('incall' is derived live, not stored.)
 try { db.exec("ALTER TABLE users ADD COLUMN status TEXT NOT NULL DEFAULT 'active'"); } catch (e) { /* exists */ }
+// BizGaze person-id (s.userId): the SAME value whether the person signs in with their email or
+// their mobile number, so this — not the typed login identifier — is the stable identity key.
+// Provisioning matches on it to keep one Biz Connect account per person (#2 account merge).
+try { db.exec('ALTER TABLE users ADD COLUMN bizgaze_user_id TEXT'); } catch (e) { /* exists */ }
+try { db.exec('CREATE INDEX IF NOT EXISTS idx_users_bizgaze_user_id ON users(bizgaze_user_id)'); } catch (e) { /* exists */ }
 db.exec(`
 CREATE TABLE IF NOT EXISTS polls (
   id TEXT PRIMARY KEY,